Phishing Kits Now Get Past Most 2FA. Here's How Each Method Ranks

On September 22, 2026, Microsoft said it had disrupted EvilTokens, a phishing service linked to more than 12,000 compromised email inboxes at over 10,000 organizations. Six months earlier, on March 4, 2026, Microsoft and Europol disrupted Tycoon2FA, a kit that Microsoft says could get past nearly every common form of two-factor authentication (2FA), including text codes, app codes and push approvals. What this means for you: only passkeys and hardware security keys refuse to work on a fake site, and they protect fully only once the weaker sign-in methods on the same account are switched off. Neither stops the EvilTokens trick, which happens on the real site.

Key takeaways

Phishing-resistant 2FA means the method itself refuses to hand anything usable to a fake site, without relying on you to spot the fake. Among consumer options, only passkeys and FIDO security keys meet that bar, according to both CISA and NIST SP 800-63B-4.
Authenticator-app codes and push prompts with number matching share the middle tier. They stop SIM swaps and push bombing, but a relay kit can pass them to the real site in real time.
Text and voice codes rank near the bottom because they can also be stolen without any phishing, through a SIM swap. The FBI logged 971 SIM-swap complaints and $17.4 million in reported losses in 2025.
An account is only as strong as the weakest method still enabled on it. CISA warns that adding a stronger method does not automatically remove text-message codes.
No 2FA method stops you from entering an attacker's code on a real sign-in page, which is how EvilTokens worked.

What it means for you

If you use text codes only: you are protected against password leaks but not against a fake login page or a SIM swap. Adding a passkey to your email account first gives the biggest step up (see the ranking and the checklist at the end).
If you use an authenticator app or push prompts: you are safe from SIM swaps as long as text codes are switched off on that account, and, with number matching, from prompt spam, but not from relay kits like Tycoon2FA. The gap to close is phishing itself.
If you already have passkeys or a security key: your remaining risk is the fallback. Check whether a phone number or email code can still be used to sign in or recover the account (see "Fallbacks undo the top rank").
If you are a likely target (IT administrators, executives, journalists, campaign staff): CISA's advice for highly targeted people is hardware keys where feasible, with SMS removed as a second factor.
Everyone: a code you did not ask for should never be typed anywhere, even on a genuine Microsoft or Google page (see "What no 2FA method stops").

The ranking, strongest to weakest

The order below follows CISA's "MFA forms, strongest to weakest" table (October 2022), refined with NIST's final SP 800-63B-4 (July 2025) and CISA's December 2024 mobile guidance. CISA puts app codes and number-matched push in the same tier, so they share third place here. CISA's bottom row covers codes sent to a phone or an email inbox together; email is placed last here because NIST bars it as a sign-in channel, a placement that assumes the inbox is protected by a password alone.

Rank	Method	Phishing-resistant?	What can beat it	Official view
1	Hardware security key (a device-bound passkey on a USB or NFC key)	Yes	Weaker fallback methods left on the account; losing every key causes lockout, not takeover	CISA: "the most effective" where feasible. NIST: eligible for its top level, AAL3, because the key can't be copied off the device
2	Synced passkey (stored in a phone, computer or password manager and copied across your devices)	Yes	Takeover of the cloud account that syncs it; weaker fallbacks	CISA: "an acceptable alternative." NIST: allowed up to AAL2, barred at AAL3 because the key is exportable
3 (tie)	Push prompt with number matching	No	Relay (adversary-in-the-middle) kits	CISA: an interim option that resists push bombing
3 (tie)	Authenticator-app code (TOTP) or hardware code fob	No	Relay kits; typing the code into a fake page	CISA: "better than SMS" but "still vulnerable to phishing"
5	Push prompt with only Approve/Deny	No	Push bombing, relay kits, a mistaken tap	CISA: vulnerable to push bombing and user error
6	Text-message or voice-call code	No	SIM swap, network interception, relay kits	CISA: "last resort." NIST: a "restricted" authenticator
7	Code sent by email	No	Relay kits; anyone who can get into the inbox	NIST: email "SHALL NOT" be used for out-of-band authentication
Outside the ranking	Printed backup or recovery codes	No	Typing one into a fake page; theft of wherever they are kept	NIST: look-up secrets "are not phishing-resistant"

Backup codes sit outside the ranking because they are an emergency exit rather than a daily method. A one-time code is safe only as long as it is never typed into a page you reached from a link.

Why passkeys can't be relayed

NIST defines phishing resistance as the ability of the sign-in protocol to keep secrets and valid codes away from an impostor site "without relying on the vigilance of the claimant." In other words, the method has to protect you on the day you don't notice the fake address. NIST adds that any method where you type a code, including app codes and texted codes, "SHALL NOT be considered phishing-resistant," because a fake site can pass the typed code along to the real one.

A passkey (a sign-in credential built on the FIDO and WebAuthn standards) works differently. Your device creates a separate key pair for each site, and Google's developer documentation explains that the browser and operating system only let a passkey be used with the website or app that created it. NIST calls this verifier name binding: the device's answer is cryptographically tied to the site's verified web address. A look-alike domain has no matching passkey to request, and an answer produced for one address is useless at another.

The FIDO Alliance distinguishes two kinds. Synced passkeys are backed up to a cloud service with end-to-end encryption, so they survive a lost phone. Device-bound passkeys, including those on hardware security keys, never leave one device. Both block fake sites equally well at sign-in.

The difference is the attack surface around them: a synced passkey is only as safe as the Apple, Google or password-manager account that stores it, which is why NIST bars syncable keys from AAL3 and CISA calls hardware keys the most effective option.

How the weaker methods get beaten

Relay kits defeat codes and push

An adversary-in-the-middle (AitM) kit sits between you and the real site. It shows you the genuine sign-in page through its own server, passes your password and code along as you type them, and keeps the session cookie the real site sends back. Microsoft says Tycoon2FA could bypass "nearly all commonly deployed MFA methods," naming SMS codes, one-time passcodes and push notifications, and that its campaigns reached more than 500,000 organizations a month before the March 2026 disruption. The disruption did not end the threat: CrowdStrike reported that daily volumes fell to 25% of earlier levels on March 4 and 5, 2026, then returned to pre-disruption levels.

Number matching does not change this. The kit is showing you the real site's page, so the number you need to enter in your app is the real one.

Push bombing defeats plain approve prompts

With a stolen password, an attacker can trigger "hundreds of prompts" in a short period, CISA says, until the user taps Approve by accident or to make them stop. Number matching blocks this because each prompt needs a number shown only on the sign-in screen the attacker is looking at. For work and school accounts in Microsoft Entra ID, Microsoft now applies number matching to all Authenticator push notifications, and users cannot opt out; unpatched older server setups can still show plain Approve/Deny.

SIM swaps defeat text codes without phishing

In a SIM swap, a criminal persuades your carrier to move your number to a SIM card they control. The FTC warns that from then on the criminal receives your texts and calls, including verification codes. CISA adds that SS7, a signaling protocol inside phone networks, can also be exploited to intercept text and voice codes. This is why texted codes rank below app codes: both can be phished, but only texts can be taken without you doing anything.

The FBI's 2025 Internet Crime Report recorded 971 SIM-swap complaints with $17,366,758 in reported losses, down from 982 complaints and $25,983,946 in 2024. That works out to about $17,900 per complaint in 2025. These are only cases reported to the FBI, so they understate the total.

Email codes inherit the inbox's weaknesses

NIST bars email as an out-of-band sign-in channel because an inbox may be reachable with only a password and messages can be intercepted or rerouted. The guidelines still allow emailed codes for confirming an address or as issued recovery codes, so many services keep using them. If your email account is protected only by a password, every code sent to it is protected only by that password too. An inbox locked with a passkey is much harder to break into, but an emailed code is still typed by hand, so a relay kit can pass it along like any other code.

Fallbacks undo the top rank

A passkey ranks first only if an attacker can't simply pick a different door. CISA's 2024 mobile guidance says that once you enroll in FIDO, you should disable other, less secure methods, and it flags a common trap:

"Enrollment in authenticator-based MFA does not automatically unenroll the account's SMS." (CISA, Mobile Communications Best Practice Guidance, December 2024)

Security researchers at Proofpoint showed in August 2025 how a relay kit could pretend to be a browser that doesn't support passkeys, so a Microsoft Entra ID sign-in page offers "an alternative sign in method" instead. The attack works only if the account has another method enabled besides FIDO. Proofpoint said it had not seen the technique used in real attacks.

Recovery is the other back door. CISA notes that some services fall back to text messages during account recovery, so removing SMS completely may not be possible.

Services that let you go further say what it costs. Google's Advanced Protection Program requires a passkey or security key and tightens recovery, which can take a few days. With security keys on an Apple Account, the six-digit verification code is no longer an option, but Apple warns that losing all keys and trusted devices could lock you out permanently.

What no 2FA method stops

EvilTokens used a different trick, called device code phishing. Microsoft's security team explains that the attacker starts a sign-in meant for devices without a keyboard, such as a TV or conference-room screen, and sends the victim the resulting code in a convincing email. The victim enters it at Microsoft's legitimate portal and unknowingly authorizes the attacker's session.

Microsoft's write-up recommends phishing-resistant methods such as FIDO keys and passkeys as general practice, but it does not say they stop this attack. The logic follows from NIST's definition: because the victim really is on Microsoft's site, there is no impostor for origin binding to catch, so a passkey would complete the sign-in like any other method. Microsoft's announcement of the disruption says the resulting access could persist even after a password reset unless the sessions and tokens were also revoked. It obtained a court order in the Eastern District of Virginia to seize 50 websites, and UK police arrested two men on September 11, 2026.

Microsoft's own documentation calls device code flow "a high-risk authentication method" and recommends that employers block it wherever possible. For individuals, the rule is simpler: a code that arrives in an email, text or call asking you to enter it somewhere is a request to sign someone else in.

Frequently asked questions

Do I need more than one security key?

For an Apple Account, yes: Apple requires at least two FIDO Certified keys that work with the Apple devices you regularly use, and allows up to six. The devices need iOS 16.3, iPadOS 16.3, macOS Ventura 13.2 or later, and child accounts and Managed Apple Accounts can't use keys. Elsewhere a second key isn't always required, but a spare kept somewhere safe is what lets you remove weaker fallbacks without risking a lockout.

Can I remove my phone number from every account?

Often not completely. CISA notes that some services default to text messages during recovery. Where a number has to stay, CISA recommends adding a PIN and 2FA to your mobile carrier account, and the FTC also suggests a PIN or password on the cellular account to block unauthorized changes such as a SIM swap.

What does an MFA prompt I didn't request mean?

Deny it and treat your password as exposed. CISA points out that 2FA checks run after the password step succeeds, so a prompt you didn't trigger can mean someone already has your password. Change it from a page you open yourself, not from a link.

Is Advanced Protection only for high-risk people?

Google aims it at people likely to be targeted, such as campaign teams, activists and IT staff, and says the program costs nothing to use; only the security keys, if you buy them, cost money. Beyond requiring a passkey or security key, it blocks app passwords, limits third-party app access and adds checks on suspicious downloads. CISA's guidance for highly targeted individuals recommends it for Gmail users.

Do government websites have to offer passkeys?

Not passkeys specifically, but federal agencies must offer a phishing-resistant option, which can also be a smart card or other PKI-based method. The White House budget office's memo M-22-09 (January 2022) requires it for agency staff and says that for public users "phishing-resistant MFA must be an option." NIST's 2025 guidelines likewise require services at AAL2 to offer at least one phishing-resistant option. These rules cover federal systems; banks and apps are not bound by them.

Upgrade one account this week

Start with your main email account, because it can reset most of your other passwords.
Add a passkey, or two hardware security keys, in that account's security settings.
Open the list of sign-in and verification methods and remove text, voice and email codes where the service allows it. On many services, adding a passkey leaves them switched on.
Where a phone number has to stay for recovery, set a PIN on your mobile carrier account.
Print or save the account's backup codes, store them offline, and never type one into a page you reached from a link.
If an authenticator app still offers plain Approve/Deny prompts, switch to a passkey or a method that shows a number to match.
Never enter a code someone sends you, even on a real Microsoft or Google page.
Repeat for your bank, phone carrier, password manager and the Apple or Google account that syncs your passkeys.