Unverified50% confidenceFactExact time
Attacks against real-time phishing proxies (such as Evilginx) can intercept session tokens, so MFA is not a panacea.
1
Sources
50%
Confidence
Long-term
Relevance
10/20/2026
First Seen
Sources
Related Entities
Related Claims
UnverifiedAnti-phishing MFA (such as FIDO2/WebAuthn hardware keys or platform passkeys) can resist real-time phishing and man-in-the-middle attacks, because authentication is bound to the origin of the specific website, and a phishing domain cannot obtain a valid signed challenge response.68% similarUnverifiedAPT attackers actively clear logs, forge timestamps, and leverage legitimate tools (i.e., Living off the Land) to evade detection.66% similarUnverifiedSMS verification code-based MFA is susceptible to SIM-swapping attacks, while push notification-based MFA may be defeated by MFA fatigue attacks.66% similarUnverifiedTool abuse refers to an Agent being induced to call legitimate tools with parameters desired by the attacker, often by combining first querying PII and then sending data out via email or webhook, which boundary defenses typically do not intercept.65% similarUnverifiedEven if an Agent is hijacked by a Prompt Injection attack, hard-blocking at the gateway layer can still prevent unauthorized operations.65% similar
Cite This Claim
Stable URI
https://kongchang.com/claim/1074929API
curl https://kongchang.com/api/v1/knowledge/claims/1074929MCP
get_claim(id=1074929)