Still Think MFA Makes Your Accounts Untouchable?

MFA blocks a significant majority of automated attacks. Attackers adapted.

Spoof websites hosted on legitimate Azure domains now capture tokens in real-time. Filters treat these domains as trusted. Users see familiar branding and submit credentials without hesitation.

Meanwhile, HTML obfuscation refreshes every 37 days, according to Microsoft research. Email security never catches up. By the time your filters learn the pattern, attackers have moved on.

Why This Matters Now

Email weaponization tools are no longer exclusive to skilled threat actors. Freely available kits lower the barrier for non-technical criminals to launch spear phishing campaigns that mimic legitimate services.

Traditional email filters rely on signature-based detection. When obfuscation changes faster than filter updates, phishing emails reach inboxes undetected. Hosting spoof sites on Azure or other trusted cloud platforms adds another layer of legitimacy that bypasses domain reputation checks.

Once a user clicks through, real-time token capture defeats MFA. The attacker intercepts the session token before it expires, gaining access without needing the original password. This transforms MFA from a reliable safeguard into a false sense of security.

Organizations now face a challenge that technical controls alone cannot solve. The human layer becomes the critical defense when attackers exploit trust, familiarity, and timing.

Three Strategic Gaps Exposed

Filter-Based Detection Cannot Match Obfuscation Velocity

Attackers rotate HTML obfuscation techniques every 37 days. Email filters depend on static rules and signature databases that update far less frequently.

• Filter updates lag behind attacker innovation, creating detection gaps
• Obfuscated HTML bypasses content inspection by altering structure without changing intent
• Organizations deploy filters expecting comprehensive protection but receive partial coverage
• Security teams lack visibility into how many obfuscated emails reached users

Trusted Hosting Environments Provide Attacker Cover

Spoof websites hosted on Azure domains inherit the reputation of the platform. Domain reputation filters see a Microsoft property and pass the email through.

• Legitimate cloud hosting gives phishing sites an air of credibility
• Users trained to check URLs see a familiar domain structure and trust it
• Security tools cannot distinguish between legitimate Azure sites and attacker-controlled pages
• Attackers exploit the trust extended to enterprise cloud providers

MFA Protects the Password but Not the Session

Token theft tools capture the authenticated session after MFA completes. The attacker never needs the password or the second factor.

• Real-time token capture happens within the session timeout window
• MFA secures initial authentication but leaves the session exposed
• Organizations assume MFA closes the access risk when it only narrows it
• Users cannot detect token theft because nothing appears broken in their workflow

The Strategic Shift Required

Security awareness must evolve from teaching users to spot obviously suspicious emails to recognizing subtle indicators of weaponization. Obfuscation, trusted hosting, and session hijacking all leave behavioral signals that filters miss but trained users can identify.

This requires moving beyond checkbox compliance training. Users need exposure to realistic simulations that mirror actual attacker tactics, including HTML obfuscation and spoof sites hosted on legitimate infrastructure.

Organizations must also shift from measuring training completion to measuring behavioral outcomes. Tracking your Phish-prone Percentage reveals which users remain vulnerable and where additional training focus is needed.

• Simulate obfuscation techniques users will encounter in live attacks
• Train users to question familiar branding on unfamiliar login prompts
• Measure click-through rates on simulated phishing to identify gaps
• Integrate human risk management into your broader security posture

How Security Awareness Training Addresses This

KnowBe4 Security Awareness Training uses phishing simulation that replicates the obfuscation, spoofing, and social engineering tactics attackers deploy in real campaigns.

• Filter-Based Detection Gaps: Simulations expose users to obfuscated phishing emails so they learn to recognize indicators that automated tools miss.
• Trusted Hosting Exploitation: Training modules teach users to verify login prompts even when they appear on familiar domains, reducing trust-based click-through.
• MFA Session Vulnerabilities: Realistic simulations demonstrate how spoof sites capture credentials and tokens, reinforcing skepticism around unsolicited login requests.

The platform tracks your Phish-prone Percentage over time, providing a measurable indicator of how training reduces risk. This metric quantifies improvement and identifies which user groups require additional focus.

Who This Is For

• Security Awareness Managers building programs to address weaponized email threats
• InfoSec Managers seeking measurable reductions in phishing susceptibility
• IT Security Admins responsible for reducing click-through on malicious links
• Compliance Officers demonstrating human risk management in audit contexts

Call to Action

See how phishing simulations reduce your Phish-prone Percentage before attackers test your users. Visit https://content.optrics.com/knowbe4-hrm-plus

FAQ

How often do attackers change obfuscation techniques?
Microsoft research indicates attackers refresh HTML obfuscation approximately every 37 days, outpacing the update cycles of most email security filters.

Can MFA still provide protection if tokens are stolen?
MFA secures initial authentication but does not prevent session token theft. Once an attacker captures a valid token, they can access the account without triggering MFA again within that session.

Why do spoof sites hosted on Azure bypass filters?
Email filters often trust domains associated with established cloud providers. When attackers host spoof sites on Azure infrastructure, the domain reputation appears legitimate, allowing phishing emails to pass through.

What is Phish-prone Percentage?
Phish-prone Percentage measures the proportion of users who click on simulated phishing emails. It provides a quantifiable metric for assessing human risk and tracking improvement over time.