Identity attacks and MFA gaps are now the front line of Australian cyber security. Multi-factor authentication is still one of the most valuable controls you can deploy, and every organisation should have it switched on everywhere. But attackers have adapted, and in 2026 they routinely defeat weak MFA through push bombing, adversary-in-the-middle phishing and session token theft. The uncomfortable truth is that having MFA enabled is not the same as being protected.
This guide explains how modern identity attacks work, why MFA alone is no longer enough, and what Australian organisations should do to test and harden their identity systems. The aim is not to scare you away from MFA but to help you deploy the strong version of it and protect what happens after login.
Why Identity Became the Primary Target
Attackers overwhelmingly prefer to log in rather than break in. A valid credential provides a legitimate-looking path into an environment that generates far fewer alarms than malware. Once inside, an attacker with a real identity can read email, access files, move to connected systems and escalate privileges, often without tripping the defences built to catch intrusions.
Several factors make identity so attractive:
- Credentials are widely traded, harvested through phishing and stolen by info-stealing malware.
- Password reuse means one leaked credential can unlock several services.
- Single sign-on concentrates access, so one compromised identity can reach many applications.
- Valid logins blend in with normal activity, delaying detection.
Because identity has become the primary target, the strength of your identity controls now largely determines the strength of your whole security posture.
Not All MFA Is Equal
The phrase "we have MFA" hides an enormous range of security. The method matters enormously, and attackers focus their effort on the weaker end of the spectrum.
| MFA method | Resistance to modern attacks |
|---|---|
| SMS one-time codes | Weak: phishable and vulnerable to interception |
| App-based codes | Moderate: phishable through fake login pages |
| Simple approve or deny push | Weak: vulnerable to push bombing |
| Number-matching push | Better: resists blind approval attacks |
| Hardware keys and passkeys | Strong: phishing-resistant by design |
The pattern is clear. Any method that produces a secret the user can be tricked into entering on a fake page can be phished. Phishing-resistant methods remove that secret entirely, which is why moving to hardware keys and passkeys for high-value accounts is one of the highest-impact changes an Australian organisation can make.
MFA Fatigue and Push Bombing
One of the simplest and most effective attacks against weak MFA is push bombing, also called MFA fatigue. When an attacker already holds a valid password, they trigger repeated push notifications to the user's device, hoping the person eventually approves one out of confusion, habit or a desire to make the prompts stop.
This works against simple approve-or-deny prompts because approval takes a single tap. Defences are straightforward:
- Move to number matching, which forces the user to enter a code shown on the login screen.
- Limit the number of prompts and lock accounts after repeated failures.
- Educate users that unexpected prompts mean their password is already compromised.
- Prefer phishing-resistant methods that remove the approve-or-deny model altogether.
Adversary-in-the-Middle Phishing
The technique that most clearly shows why MFA alone is not enough is adversary-in-the-middle. Instead of a crude fake page, the attacker runs infrastructure that proxies the genuine login service in real time. The victim sees the real site, enters their password and multi-factor code, and everything works, because the attacker is quietly relaying it all to the legitimate service.
The critical prize is not the password but the session token issued after successful authentication. With that token, the attacker can access the account directly, without needing to authenticate again. This is why many forms of MFA can be defeated by a single convincing phishing page.
The strongest defence is phishing-resistant MFA that binds authentication to the legitimate domain, so the credentials simply cannot be replayed elsewhere. Alongside that, monitoring for tokens used from unexpected locations or devices helps catch abuse quickly.
Token and Session Theft
Even without phishing, attackers can steal the session tokens that keep users logged in. Info-stealing malware on an endpoint can harvest browser cookies and tokens, handing an attacker a ready-made session. Insecure applications can also leak tokens that should have been protected.
Reducing this risk means treating sessions as valuable assets:
- Keep session lifetimes short for sensitive applications and re-authenticate for high-risk actions.
- Bind tokens to devices where the platform supports it.
- Monitor for sessions appearing from new devices, locations or impossible travel patterns.
- Reduce malware exposure through endpoint protection and controlled software installation.
OAuth and Application Consent Abuse
Modern environments are full of connected applications that request access to data through consent-based authorisation. Attackers exploit this by tricking users into approving a malicious application, which then receives ongoing access through granted permissions rather than a stolen password. Because the access is authorised, it can persist even after a password reset.
Sensible controls include:
- Restricting which applications users can consent to, and requiring administrator approval for sensitive permissions.
- Reviewing granted application permissions regularly and removing those no longer needed.
- Watching for newly consented applications with broad access to mail or files.
Hardening the Directory: Entra ID and Active Directory
Most Australian organisations run their identity on Entra ID, on-premises Active Directory, or a hybrid of both. These directories are powerful, and their configuration has an outsized effect on security. Attackers who gain a foothold frequently target the directory to escalate privileges and establish persistence.
Common weaknesses worth checking include:
- Excessive privileged accounts and standing administrative access.
- Legacy authentication protocols that bypass modern MFA policies.
- Misconfigured conditional access that leaves gaps for certain apps, locations or devices.
- Weak protection of the most sensitive administrative roles and recovery paths.
- Trust relationships and synchronisation settings between cloud and on-premises directories.
Because these settings are complex and interdependent, they benefit greatly from expert review and realistic testing rather than a one-time configuration check.
How to Test and Harden Identity
The recurring theme is that identity posture must be validated, not assumed. Offensive security testing is the most reliable way to find out whether your controls hold up against the techniques attackers actually use.
Testing can:
- Attempt realistic phishing and adversary-in-the-middle scenarios to see what your users and controls do.
- Probe MFA configurations for weak methods and coverage gaps.
- Assess directory and single sign-on settings for privilege and configuration weaknesses.
- Measure how quickly a compromised account is detected and contained.
This is where red teaming proves its value, because it tests the full path from an initial identity compromise through to your detection and response. A focused penetration test of your identity and access configuration surfaces the technical gaps, while adversary simulation lets you rehearse a specific identity-compromise scenario end to end. If an account is compromised, well-rehearsed incident response is what limits the damage.
From Enabled to Actually Protected
MFA is not the problem. Weak MFA and unprotected sessions are the problem. The organisations that stay ahead in 2026 are those that move to phishing-resistant methods, tighten their directory configuration, protect the sessions that authentication creates, and test all of it against realistic attacks.
If you want to know whether your identity controls would withstand a determined attacker, our team of expert operators can help you find out and fix what matters. Explore our penetration testing services, review our red teaming capability, or get in touch to scope an assessment. You can also call StrikeCyber on 1300 654 898.
Frequently asked questions
Is multi-factor authentication still worth using in 2026?
Absolutely. Multi-factor authentication remains one of the most effective controls an organisation can deploy, and turning it on everywhere is still essential. The point is not that MFA has failed, but that not all MFA is equal. Weak methods such as SMS codes and simple push approvals can be bypassed by modern techniques, while phishing-resistant methods such as hardware security keys and passkeys are far more robust. The goal in 2026 is to move to strong MFA and to protect the sessions and tokens that authentication creates, rather than assuming any MFA is enough on its own.
What is MFA fatigue or push bombing?
MFA fatigue, also called push bombing, is an attack where a criminal who already has a valid password triggers repeated multi-factor push notifications to a user's device. The aim is to annoy or confuse the user into approving one prompt, either by accident or to make the notifications stop. It works against simple approve or deny push prompts. Number matching, which requires the user to enter a code shown on the login screen, and phishing-resistant methods such as passkeys, defeat this technique.
What is an adversary-in-the-middle attack?
An adversary-in-the-middle attack places the attacker's infrastructure between the user and the real login page, usually through a convincing phishing site that proxies the genuine service. When the user enters their password and multi-factor code, the attacker captures both and, critically, the resulting session token. That stolen token lets the attacker access the account without needing to authenticate again, which is why this technique can defeat many forms of multi-factor authentication. Phishing-resistant methods that bind authentication to the legitimate domain are the strongest defence.
How do attackers steal session tokens?
Once a user authenticates, the service issues a session token or cookie that keeps them logged in. Attackers steal these tokens through adversary-in-the-middle phishing, through info-stealing malware on the user's device, or by exploiting insecure applications. With a valid token an attacker can resume the session without a password or a multi-factor prompt. Defences include short session lifetimes, binding tokens to devices where possible, monitoring for anomalous session use, and reducing malware exposure on endpoints.
How can we test whether our identity controls are strong enough?
Offensive security testing is the most reliable way to validate identity controls. Testing can attempt realistic phishing and adversary-in-the-middle scenarios, probe multi-factor configurations for weak methods, assess directory and single sign-on settings such as those in Entra ID and Active Directory, and check how quickly a compromised account is detected and contained. This turns assumptions about your identity posture into evidence, and produces a prioritised list of fixes rather than a vague sense that MFA is enabled.
What is phishing-resistant MFA?
Phishing-resistant multi-factor authentication is a class of methods that cannot be captured and replayed by a phishing site, because authentication is cryptographically bound to the legitimate service and the user's device. The main examples are hardware security keys and passkeys based on modern authentication standards. Unlike SMS codes or simple push approvals, these methods do not produce a secret the user can be tricked into handing over, which is why they defeat adversary-in-the-middle and credential phishing attacks.