Social Engineering Attacks Target MFA Enrollment and Recovery

• •Attacks increasingly target MFA enrollment and recovery processes.
• •Okta reported 20% of recent phishing notifications involved 'passkey' domains.
• •Attackers exploit weaknesses in self-service password resets and impersonate IT support.

Over the past year, Okta Threat Intelligence has reported a rise in attacks where users are tricked into approving multi-factor authentication (MFA) enrollments and password resets initiated by attackers. These social engineering tactics have evolved, with attackers impersonating IT support to lure users into phishing traps. Recent campaigns have targeted passkey enrollment processes, exploiting the transition to phishing-resistant MFA. Okta noted that 20% of proactive notifications to customers in the last month were related to phishing domains containing 'passkey.' Microsoft also reported similar incidents where attackers bypassed authentication controls by manipulating self-service password reset processes. This trend highlights vulnerabilities in account recovery methods, which remain less secure than primary authentication. Organizations are urged to prioritize strengthening MFA enrollment and recovery processes to mitigate these risks.