- Join Our Company
- Email: sanjay@pjnetworks.com
- Phone: +91-9818361787
Multi-factor authentication was supposed to be the silver bullet. After years of advice from CISOs, regulators, and security vendors, Indian enterprises finally deployed MFA across their critical systems — only to discover that attackers had quietly built tools specifically designed to defeat it. Today, two techniques — MFA fatigue attacks and Adversary-in-the-Middle (AiTM) phishing — are systematically stripping away the protection that MFA promised, and Indian IT leaders must understand exactly how these attacks work before they can defend against them.
This is not a theoretical risk. In 2023 and 2024, threat groups including APT28, Scattered Spider, and several financially motivated ransomware affiliates used AiTM frameworks to compromise organisations that had fully deployed MFA. If your organisation adopted MFA and declared the job done, your security posture may be less robust than you think.
MFA fatigue — also called push bombing or push harassment — exploits a fundamental design assumption of mobile push-based authentication: that users will only approve login requests they initiated themselves. The attack is disarmingly simple.
The attacker obtains a user’s username and password, typically through credential stuffing, a prior phishing campaign, or purchase from a dark web broker. They then attempt to log in repeatedly, triggering a flood of push notification requests to the victim’s authenticator app. The attacker may also call the victim, impersonating an IT helpdesk colleague, to claim that a “system update” requires them to approve the notification. Fatigued or confused users — especially in busy enterprise environments — frequently approve the prompt just to make the alerts stop.
A single approved push notification is all the attacker needs. At that point, MFA is completely bypassed, and the attacker holds a valid, authenticated session with full access to whatever that account can reach.
Indian enterprises are increasingly in scope. Financial services firms, IT/ITeS companies, manufacturing conglomerates, and healthcare networks all face MFA fatigue campaigns because attackers know that Indian organisations have accelerated MFA rollout post-CERT-In directives without always pairing it with phishing-resistant alternatives or robust user awareness programmes. Large workforces, high email volumes, and multiple legacy portals create ideal conditions for push-bomb success.
Where MFA fatigue exploits human behaviour, Adversary-in-the-Middle (AiTM) phishing exploits the technical architecture of web authentication itself. It is more sophisticated but increasingly commoditised — AiTM-as-a-service kits are available on cybercriminal forums for as little as a few hundred dollars.
In a standard AiTM attack, the threat actor stands up a reverse-proxy phishing site between the victim and the legitimate service. When a user enters their credentials on the phishing page, the proxy relays them in real time to the real login server, including any MFA tokens or session cookies. The attacker captures the authenticated session token before the user’s browser does — effectively stealing their session after authentication completes, without ever needing the user’s MFA code directly.
Frameworks like Evilginx and Modlishka have made AiTM attacks accessible to attackers with limited technical skill. These open-source reverse-proxy tools were designed for legitimate penetration testing, but their capabilities — including HTTPS certificate management, automatic session cookie harvesting, and integration with popular phishing lure templates — are routinely abused. A threat actor can stand up a fully functional AiTM phishing site targeting Microsoft 365, Google Workspace, or any SAML-federated application in a matter of hours.
The stolen session token is then replayed into a fresh browser, bypassing authentication entirely because the server has already issued a valid session — complete with MFA proof. The victim and the IT team have no immediate indication that anything went wrong.
For Indian enterprises, a successful AiTM attack carries compliance consequences beyond the immediate operational damage.
Under CERT-In’s 2022 directions, organisations must report cybersecurity incidents — including unauthorised access to data systems — within six hours of detection. A session hijacking event that goes undetected for days or weeks (as is typical in AiTM campaigns) almost certainly triggers this obligation retroactively, with significant penalty exposure. Meanwhile, the Digital Personal Data Protection (DPDP) Act 2023 imposes obligations around the security of personal data. A compromised account accessing HR systems, customer databases, or any store of personal data could constitute a personal data breach requiring notification to the Data Protection Board of India.
The combination of CERT-In’s six-hour clock and the DPDP Act’s breach notification requirements makes fast detection of AiTM and MFA fatigue attacks not just a security objective but a legal one. The ability to correlate signals across authentication logs, email gateways, and endpoint telemetry — quickly — is what separates organisations that stay compliant from those that face enforcement action.
Organisations that rely on a traditional SIEM with static correlation rules frequently miss AiTM attacks because the attack produces no obviously anomalous events in isolation. Each step looks legitimate: the user authenticated successfully, MFA was satisfied, and a session was opened. The anomaly only becomes visible when you correlate across multiple signals — the source IP of the session, the geographic location compared to the user’s normal patterns, the time delta between authentication and the next action, and the types of data subsequently accessed.
This is why siloed, alert-heavy approaches fail. A SOC analyst drowning in thousands of low-fidelity alerts per day cannot realistically reconstruct an AiTM session hijacking story from raw log data. The signal is there, but the context is not.
The core defence against both MFA fatigue and AiTM phishing is to move to phishing-resistant MFA — authentication methods that are architecturally immune to these techniques.
FIDO2-based authentication (hardware security keys such as YubiKey, or device-bound passkeys) is the strongest available option. The cryptographic handshake is bound to the specific origin — the legitimate website’s domain — meaning an AiTM proxy site cannot replay the credential because the authenticator will refuse to sign for an unrecognised origin. This breaks the AiTM attack at the protocol level, not the user-behaviour level.
For Indian enterprises, FIDO2 rollout typically begins with privileged users — system administrators, finance approvers, and C-suite accounts — before extending to the broader workforce. Hardware keys for high-value targets, device passkeys for standard users.
Where FIDO2 hardware is impractical, certificate-based authentication using device or smart-card certificates offers a strong alternative. CBA is similarly phishing-resistant because the private key never leaves the device and is cryptographically bound to the user session. Microsoft Entra ID and on-premises Active Directory Federation Services both support CBA with PKI infrastructure.
As an interim measure for organisations still running push-based MFA, enabling number matching (requiring the user to type a code displayed on the login screen into the push notification) and geographic/IP anomaly alerts significantly raises the bar for MFA fatigue attacks. Microsoft Authenticator, Okta Verify, and Duo all support these controls. They do not defeat AiTM, but they substantially reduce push-bomb success rates.
Even with phishing-resistant MFA deployed, no defence is absolute. Organisations must assume that some attacks will succeed and build detection capabilities to shrink the dwell time window.
Effective detection requires correlating signals from identity providers (Microsoft Entra ID, Okta), email gateways (FortiMail, Microsoft Defender for Office 365), endpoint telemetry, and network logs within a unified platform. Doing this across a large Indian enterprise with a distributed workforce and multiple business applications requires automation — human analysts cannot correlate at the speed these attacks demand.
Detecting MFA fatigue and AiTM attacks at enterprise scale requires a platform that can ingest authentication, email, network, and endpoint telemetry simultaneously and surface attack storylines fast enough to meet CERT-In’s six-hour reporting window. PrahiX Ora is a unified SecOps platform built by PrahiX Tech Pvt Ltd; PJ Networks is its primary field deployment and operations partner, and we deploy and operate it for clients across Indian manufacturing, financial services, and IT/ITeS sectors.
SIEM: PrahiX Ora’s SIEM layer ingests logs from identity providers, email gateways, firewalls, and endpoint agents into a multi-source correlation engine. Correlation rules are mapped to the MITRE ATT&CK framework — AiTM-related techniques (T1557, T1539 — session token theft) are pre-mapped with detection logic. A graph-based attack storyline view reconstructs the kill chain visually, enabling analysts to see the relationship between a suspicious login, a subsequent mailbox rule creation, and a bulk download event as a single connected narrative rather than three separate alerts. On retention, the platform supports tiered hot/cold/archive storage aligned with CERT-In’s direction on 180-day in-country log retention — ensuring that forensic data is available for regulatory review without spiralling storage costs.
NMS: The Network Management System pillar provides unified observability across FortiGate firewalls, switches, wireless access points, and WAN/SD-WAN links. LLDP/CDP topology discovery gives the SOC an accurate map of which device is where — critical when investigating whether a compromised session is pivoting laterally across network segments. ML-based anomaly detection flags unusual traffic patterns, such as a workstation making unexpected connections to internal file servers, that are characteristic of post-compromise lateral movement. For Indian enterprises running multi-vendor estates — common in organisations that have grown through acquisition — the platform’s vendor-agnostic approach means the NOC maintains a single unified view rather than toggling between disconnected management consoles.
Video Surveillance (VMS): The video surveillance pillar integrates ONVIF-compatible cameras — including Hikvision and Dahua deployments common across Indian manufacturing and retail sites — with video analytics under the same operational dashboard. For CISOs managing multi-site or campus estates, the ability to correlate a physical tailgating event (captured on camera) with an authentication anomaly on the same floor at the same time creates an investigation context that purely digital monitoring cannot provide. Security operations and physical security converge into a single view, reducing the gap between physical and network security posture.
SOAR: The SOAR layer is where detection becomes response. Pre-built playbooks include automated response actions for common attack patterns: when an impossible-travel alert fires, the playbook can automatically push an updated blocklist to FortiGate, revoke the active session in the identity provider, and open a ticket for SOC analyst review — all within seconds. For CERT-In’s six-hour reporting requirement, this automation is what makes the timeline realistic. Manual coordination between a SIEM analyst, a network team, and a CISO office simply cannot move fast enough when an AiTM attack is unfolding in real time. The platform’s pre-built connectors for FortiGate and major identity providers mean these response actions are available without months of custom integration work.
If your current SOC infrastructure relies on disconnected point tools and manual handoffs, we recommend an assessment to map your detection gaps against the AiTM and MFA fatigue threat patterns described in this post. The cost of not detecting a session hijacking attack within six hours — under CERT-In’s current framework — is both operational and regulatory.
MFA was always a transitional control, not a final destination. The trajectory for enterprise authentication is passwordless — FIDO2 passkeys as the primary credential, with continuous identity verification layered on top through device health signals, behavioural analytics, and network posture checks. This approach eliminates the phishable credential entirely, removing the pre-condition that makes both MFA fatigue and AiTM attacks possible.
For Indian enterprises, the path to passwordless runs through identity consolidation (a single identity provider for all applications), device management maturity (endpoint management for all corporate devices), and security operations capability (a SOC that can monitor and respond to identity-layer threats). None of these are overnight projects, but they are achievable in 12–18 months with structured execution.
The organisations that start this journey now — rather than waiting for a breach to force the issue — are the ones that will be in a defensible position when regulators, clients, and auditors begin asking harder questions about authentication security under the DPDP Act framework.
MFA is not broken — but relying on it without understanding its limitations is a dangerous posture. AiTM phishing and MFA fatigue attacks are mature, actively used techniques that have successfully bypassed MFA at organisations of every size and sector. Indian enterprises face these threats in the context of strict CERT-In reporting timelines, the DPDP Act’s personal data protection obligations, and the operational reality of large, distributed workforces accessing dozens of cloud applications daily.
The answer is a layered approach: phishing-resistant MFA for privileged accounts now, Conditional Access hardening for all users, and a detection capability sophisticated enough to spot session hijacking within minutes rather than days. If your current SIEM and SOC are not equipped to correlate authentication anomalies at this speed, that gap needs to close before the next AiTM campaign reaches your organisation.
PJ Networks helps Indian enterprises assess their MFA posture, deploy phishing-resistant authentication alongside FortiGate network controls, and operate 24/7 SOC coverage through the PrahiX Ora platform. Contact our security advisory team to schedule an AiTM readiness assessment for your organisation.