In *2019*, Alex Weinert of Microsoft wrote in https://techcommunity.microsoft.com/t5/microsoft-entra-azure-ad-blog/all-your-creds-are-belong-to-us/ba-p/855124:

«
    MFA had failed.

    [...]
    All Authenticators Are Vulnerable
    [...]
»

Today, as echoed in https://www.bleepingcomputer.com/news/microsoft/microsoft-enable-mfa-or-lose-access-to-admin-portals-in-october/, Microsoft still insists that using weak MFA is a good idea.

In https://azure.microsoft.com/en-us/blog/announcing-mandatory-multi-factor-authentication-for-azure-sign-in/ Microsoft writes (on August 15):

«
As recent research [1] by Microsoft shows that multifactor authentication (MFA) can block more than 99.2% of account compromise attacks, making it one of the most effective security measures available, today’s announcement brings us all one step closer toward a more secure future.
»

From that same article, "solutions" with (nearly as weak as SMS) "Microsoft Authenticator" is at the TOP of their list:

«
Organizations have multiple ways to enable their users to utilize MFA through Microsoft Entra:

• Microsoft Authenticator [...]
• FIDO2 security keys [...]
• Certificate-based authentication [...]
• Passkeys [...]
• Finally, and this is the least secure version of MFA, you can also use a SMS or voice approval [...]
»

From [1] (PDF) = https://query.prod.cms.rt.microsoft.com/cms/api/am/binary/RW166lD?culture=en-us , no date of the "investigation period" to be seen *anywhere*, and one of the authors being Alex Weinert, more extreme percentages (approved by Microsoft's marketing dept):

«
Our findings reveal that MFA implementation offers outstanding protection, with over 99.99% of MFA-enabled accounts remaining secure during the investigation period. Moreover, MFA reduces the risk of compromise by 99.22% across the entire population and by 98.56% in cases of leaked credentials.
»

Dear reader: please stop buying Microsoft BS that completely ignores PhaaS.

To name a few examples:

"Experts agree [*] that setting up two-factor authentication (2FA) İs one of the most powerful ways to protect your account from getting hacked. However, hackers like COLDRIVER and COLDWASTREL may try to trick you into entering your second factor; we have seen attackers successfully compromise a victim who had enabled 2FA." - (PDF) https://www.accessnow.org/wp-content/uploads/2024/08/Spearphishing-cases-in-Eastern-Europe-2022-2024-technical-brief.pdf

[*] Not me. My tip is here: https://infosec.exchange/@ErikvanStraten/112724966066248808

EvilGinx2: "Standalone man-in-the-middle attack framework used for phishing login credentials along with session cookies, allowing for the bypass of 2-factor authentication" - https://github.com/kgretzky/evilginx2 (there are more, like Modlishka, Muraena, CredSniper, EvilProxy (Phaas), NakedPages etc.)

Not even a fake website needed: https://www.bleepingcomputer.com/news/security/new-greatness-service-simplifies-microsoft-365-phishing-attacks/

From https://mrd0x.com/attacking-with-webview2-applications/:
«
Bypass 2FA
WebView2 also provides built-in functionality to extract cookies. This allows an attacker to extract cookies after the user authenticates into the legitimate website. This technique removes the need of having to spin up Evilginx2 or Modlishka but the obvious trade-off is that the user must execute the binary and authenticate.
»
In addition, from https://www.bleepingcomputer.com/news/security/clever-phishing-method-bypasses-mfa-using-microsoft-webview2-apps/:
«
"Yubikeys can't save you because you're authenticating to the REAL website not a phishing website."
mr.d0x
»
AND:
«
However, as mr.d0x admits and Microsoft pointed out in their response to our questions, this attack is a social engineering attack and requires a user to run a malicious executable.
»
Correct, but a local compromise does'nt protect you when you're using FIDO2 hardware keys or passkeys.

From 2022: https://microsoft.com/en-us/security/blog/2022/07/12/from-cookie-theft-to-bec-attackers-use-aitm-phishing-sites-as-entry-point-to-further-financial-fraud/:
«
A large-scale phishing campaign that used adversary-in-the-middle (AiTM) phishing sites stole passwords, hijacked a user’s sign-in session, and skipped the authentication process even if the user had enabled multifactor authentication (MFA).
»

"Phishing with Cloudflare Workers: Transparent Phishing and HTML Smuggling" - https://www.netskope.com/blog/phishing-with-cloudflare-workers-transparent-phishing-and-html-smuggling

"New EvilProxy Phishing Service Allowing Cybercriminals to Bypass 2-Factor Security" - https://thehackernews.com/2022/09/new-evilproxy-phishing-service-allowing.html

From https://www.europol.europa.eu/media-press/newsroom/news/international-investigation-disrupts-phishing-service-platform-labhost:
«
The investigation uncovered at least 40 000 phishing domains linked to LabHost, which had some 10 000 users worldwide.
[...]
LabRat was designed to capture two-factor authentication codes and credentials, allowing the criminals to bypass enhanced security measures.
»

"Security and Privacy Failures in Popular 2FA Apps" by Gilsenan et al. (USENIX 2023): https://www.usenix.org/conference/usenixsecurity23/presentation/gilsenan
The PDF can also be found here: https://github.com/blues-lab/totp-app-analysis-public (Aegis was one of the least problematic apps, and don't use Authy).

This is what is wrong with weak MFA/2FA:

You
 o
/|\  [device + browser]
/ \ |
v
[login.microsoftonline-aitm.com]
|
v
[login.microsoftonline.com]

(no thanks to DV-certificates).