--- title: CISA Publishes Guidelines for Preventing MFA-Evading Phishing Attacks description: CISA puts out two data sheets and a stern warning on latest phishing threat that is bypassing MFA. image: https://blog.softwarfare.com/hubfs/Blog%20Images/Hacker%20with%20laptop%20computer%20stealing%20confidential%20data%2c%20personal%20information%20and%20credit%20card%20detail_300x200.jpg --- [Skip to main content](https://blog.softwarfare.com/cisa-publishes-guidelines-for-preventing-mfa-evading-phishing-attacks#main) [![SOFTwarfare Hi-Res Logo Black](https://blog.softwarfare.com/hs-fs/hubfs/SOFTwarfare%20Hi-Res%20Logo%20Black.png?width=150&height=50&name=SOFTwarfare%20Hi-Res%20Logo%20Black.png) ![SOFTwarfare Logo](https://blog.softwarfare.com/hs-fs/hubfs/SWF%20Logos/swf_logo_white.png?width=140&height=50&name=swf_logo_white.png) ![SOFTwarfare Hi-Res Logo Black](https://blog.softwarfare.com/hs-fs/hubfs/SOFTwarfare%20Hi-Res%20Logo%20Black.png?width=105&height=35&name=SOFTwarfare%20Hi-Res%20Logo%20Black.png) ![SOFTwarfare Logo](https://blog.softwarfare.com/hs-fs/hubfs/SWF%20Logos/swf_logo_white.png?width=150&height=54&name=swf_logo_white.png)](https://www.softwarfare.com) - [Platform](https://www.softwarfare.com/zero-trust-identity) - Show submenu for Use Cases Use Cases - [Passwordless Authentication](https://www.softwarfare.com/passwordless-authentication) - [Desktop Login](https://www.softwarfare.com/desktop-login) - [Single Sign On (SSO)](https://www.softwarfare.com/single-sign-on--sso) - [Privileged Access](https://www.softwarfare.com/privileged-access) - [Secured Integration](https://www.softwarfare.com/secured-integration) - Show submenu for Enterprise Enterprise - [Verticals](https://www.softwarfare.com/verticals) - [Resources](https://www.softwarfare.com/resources) - [Defense](https://www.softwarfare.com/defense) - Show submenu for Company Company - [About Us](https://www.softwarfare.com/about-us) - [Blog](https://blog.softwarfare.com) - [Partners](https://www.softwarfare.com/partners) Open main navigation Close main navigation - [Platform](https://www.softwarfare.com/zero-trust-identity) - Show submenu for Use Cases Use Cases - Use Cases - [Passwordless Authentication](https://www.softwarfare.com/passwordless-authentication) - [Desktop Login](https://www.softwarfare.com/desktop-login) - [Single Sign On (SSO)](https://www.softwarfare.com/single-sign-on--sso) - [Privileged Access](https://www.softwarfare.com/privileged-access) - [Secured Integration](https://www.softwarfare.com/secured-integration) - Show submenu for Enterprise Enterprise - Enterprise - [Verticals](https://www.softwarfare.com/verticals) - [Resources](https://www.softwarfare.com/resources) - [Defense](https://www.softwarfare.com/defense) - Show submenu for Company Company - Company - [About Us](https://www.softwarfare.com/about-us) - [Blog](https://blog.softwarfare.com) - [Partners](https://www.softwarfare.com/partners) - [See a Demo](https://www.softwarfare.com/demo) - - - [See a Demo](https://www.softwarfare.com/demo) # CISA Publishes Guidelines for Preventing MFA-Evading Phishing Attacks by [SOFTwarfare Staff](https://blog.softwarfare.com/author/softwarfare-staff) Feb 18, 2024, 12:35:58 PM The [Cybersecurity and Infrastructure Security Agency (CISA)](https://www.cisa.gov/) is continuing its push to educate the public about the new phishing man-in-the-middle (Phishing MitM) attacks that have been spotted in the wild recently. These attacks are especially alarming due to the fact that they are successful even against accounts and systems that have deployed certain forms of multi-factor authentication (MFA). These novel attacks were recently [reported by Microsoft](https://www.microsoft.com/en-us/security/blog/2022/07/12/from-cookie-theft-to-bec-attackers-use-aitm-phishing-sites-as-entry-point-to-further-financial-fraud/), who said in a statement that it was an ongoing, "large-scale phishing campaign that used adversary-in-the-middle (AiTM) phishing sites stole passwords, hijacked a user's sign-in session, and skipped the authentication process even if the user had enabled MFA." As of the time of publishing, over 10,000 organizations were found to have been targeted since September 2021. As a response, CISA has issued [two data sheets](https://www.cisa.gov/news-events/alerts/2022/10/31/cisa-releases-guidance-phishing-resistant-and-numbers-matching) intended to help highlight these new threats and prepare consumers and industry professionals alike by informing them about phishing-resistant MFA. One document focuses on the multiple variations of these evolving attacks, how victims are targeted and how to protect themselves with advanced multi-factor authentication. The other focuses on the risks associated with systems that use mobile-push notification based MFA and ways to mitigate those risks without making changes to their existing infrastructure. In summary, CISA commented that they “…strongly urges all organizations to implement phishing-resistant MFA to protect against phishing and other known cyber-threats.” To read more or download the data sheets, check out the [original CISA announcement](https://www.cisa.gov/news-events/alerts/2022/10/31/cisa-releases-guidance-phishing-resistant-and-numbers-matching). **Tags:** [compliance,](https://blog.softwarfare.com/tag/compliance) [risk management,](https://blog.softwarfare.com/tag/risk-management) [cybersecurity](https://blog.softwarfare.com/tag/cybersecurity) ### Related Articles ##### [![Why the CFO is the Newest Cybersecurity Champion](https://blog.softwarfare.com/hs-fs/hubfs/CFO-Cyber-Champ.jpg?width=520&height=294&name=CFO-Cyber-Champ.jpg) compliance • Jan 15, 2026, 8:00:03 AM Why the CFO is the Newest Cybersecurity Champion 2 min read](https://blog.softwarfare.com/cfo-newest-cybersecurity-champion) ##### [![Zero Trust is Dead. Long Live Continuous Authentication.](https://blog.softwarfare.com/hs-fs/hubfs/Long%20live%20CA.jpg?width=520&height=294&name=Long%20live%20CA.jpg) compliance • Jan 14, 2026, 8:00:01 AM Zero Trust is Dead. Long Live Continuous Authentication. 2 min read](https://blog.softwarfare.com/long-live-continuous-authentication) ##### [![“Next-Gen MFA!” Really?](https://blog.softwarfare.com/hs-fs/hubfs/New%20and%20Improved%20Blog%20Image.png?width=520&height=294&name=New%20and%20Improved%20Blog%20Image.png) authentication • Feb 26, 2025, 11:04:05 AM “Next-Gen MFA!” Really? 3 min read](https://blog.softwarfare.com/next-gen-mfa-really) ### Subscribe to the Blog Get SOFTwarfare's latest research and insights delivered to your inbox. ###### Categories ###### Recent Posts - [SOFTwarfare Launches on Google Cloud Marketplace, Expands Public Sector Reach With Carahsoft](https://blog.softwarfare.com/softwarfare-launches-on-google-cloud-marketplace-expands-public-sector-reach-with-carahsoft) - [The Vanguard of Identity: Securing the Warfighter in the Age of Agentic Chaos](https://blog.softwarfare.com/the-vanguard-of-identity) - [Identity as the Control Plane](https://blog.softwarfare.com/identity-as-the-control-plane) - [The Shift to Adaptive Persistent Threats: Why Identity is the New Battlefield](https://blog.softwarfare.com/the-shift-to-adaptive-persistent-threats-why-identity-is-the-new-battlefield) - [The Autonomous Insider: Why Your AI Agents Need Zero Trust Authentication](https://blog.softwarfare.com/ai-agents-need-zero-trust-authentication) [![SOFTwarfare Logo Web White](https://blog.softwarfare.com/hs-fs/hubfs/SOFTwarfare%20Logo%20Web%20White%20NoR.png?width=140&height=45&name=SOFTwarfare%20Logo%20Web%20White%20NoR.png "SOFTwarfare Logo Web White")](https://www.softwarfare.com) [**Platform**](https://www.softwarfare.com/zero-trust-identity) Use Cases [Passwordless Authentication](https://www.softwarfare.com/passwordless-authentication) [Desktop Login](https://www.softwarfare.com/desktop-login) [Single Sign On (SSO)](https://www.softwarfare.com/single-sign-on--sso) [Privileged Access](https://www.softwarfare.com/privileged-access) [Secured Integration](https://www.softwarfare.com/secured-integration) **Enterprise** [Verticals](https://www.softwarfare.com/verticals) [**Resources**](https://www.softwarfare.com/resources) [Defense](https://www.softwarfare.com/defense) Company [About Us](https://www.softwarfare.com/about-us) [Blog](https://blog.softwarfare.com/) [Partners](https://www.softwarfare.com/partners) [See a Demo](https://www.softwarfare.com/demo) ©2025 SOFTwarfare. All rights reserved. [Privacy](https://www.softwarfare.com/privacy-policy)[& Terms](https://www.softwarfare.com/privacy-policy) ```json { "@context" : "https://schema.org", "@type" : "BlogPosting", "author" : { "@type" : "Person", "name" : "SOFTwarfare Staff", "url" : "https://blog.softwarfare.com/author/softwarfare-staff" }, "dateModified" : "2024-05-06T20:52:21.970Z", "datePublished" : "2024-02-18T18:35:58.000Z", "headline" : "CISA Publishes Guidelines for Preventing MFA-Evading Phishing Attacks", "image" : [ "https://blog.softwarfare.com/hubfs/Blog%20Images/Hacker%20with%20laptop%20computer%20stealing%20confidential%20data%2c%20personal%20information%20and%20credit%20card%20detail_300x200.jpg" ], "mainEntityOfPage" : { "@id" : "https://blog.softwarfare.com/cisa-publishes-guidelines-for-preventing-mfa-evading-phishing-attacks", "@type" : "WebPage" }, "publisher" : { "@type" : "Organization", "logo" : { "@type" : "ImageObject", "url" : "https://blog.softwarfare.com/hubfs/SOFTwarfare%20Logo%20Black%20Hi-res.webp" } } } ```