Multifactor authentication (MFA) is a top cybersecurity safeguard for Ontario law firms. By requiring a second form of verification, you can stop an attacker who has stolen an employee’s password. But cybercriminals have adapted, and some phishing techniques can now bypass certain types of MFA.

Microsoft highlighted that risk in March 2026 when it reported on Tycoon2FA, a phishing-as-a-service operation used to impersonate Microsoft 365, Outlook, OneDrive, SharePoint, Gmail, and other trusted services. This platform used adversary-in-the-middle phishing to intercept login credentials and then impersonate the user. What’s even more alarming is that sometimes they maintain access even after a password change.

For law firms entrusted with confidential communications and records, the message is clear: while using MFA is important, you need to be careful with your approach.

How Attackers Get Past Traditional MFA

Traditional MFA usually asks you to prove your identity with something beyond a password. Depending on the system, that second check may be a text message, a code from an authentication app, or an approval prompt sent to a mobile device. These methods are safer than password-only access, but some can still be intercepted or manipulated.

Adversary in the Middle Phishing

One method attackers use is called adversary-in-the-middle phishing. Instead of sending you to a basic fake login page, the attacker places a fraudulent site between you and the legitimate service. You enter your username and password, and the fake site relays that information to the real Microsoft 365 login page. When Microsoft asks for your second authentication factor, the fraudulent page relays that request back to you.

If you enter an MFA code or approve the login, the attacker can capture the authenticated session. In some attacks, this includes stealing a session cookie that tells Microsoft the user has already completed authentication. The attacker may then access the account without having to complete MFA again for that session.

MFA Fatigue and Help Desk Impersonation

Attackers also use MFA fatigue. They trigger repeated authentication prompts in the hope that an employee eventually taps “approve” simply to stop the notifications. With another strategy, known as help desk impersonation, a caller posing as IT support may tell an employee that a security problem requires them to approve a login request, provide a code, or visit a fraudulent sign-in page.

These attacks rely heavily on human behaviour. That means your firm’s security controls need to account for what happens after a password is stolen, not only what happens at the login screen.

Why Ontario Law Firms Are Attractive Targets

The answer is simple: law firms hold information that attackers can monetize or use for fraud. Email accounts may contain settlement discussions, banking instructions, client records, litigation documents, identification information, and internal financial data. A compromised Microsoft 365 account can also give an attacker access to SharePoint, OneDrive, Teams, and other connected services, depending on the user’s permissions.

Once an attacker controls an email account, they may monitor correspondence, study payment patterns, and wait for an opportunity to send fraudulent wire instructions or payment requests. Because the message comes from a legitimate account, employees and clients may be less likely to question it.

The risk increases when senior lawyers, finance staff, administrators, or IT personnel have broad account privileges. A compromised user with elevated access can give an attacker a larger reach across the firm’s systems. That’s why MFA should be paired with access controls, monitoring, and policies that limit privileges to what each person needs for their role.

For TLOMA members, this isn’t solely an IT issue. Office administrators, finance leaders, HR professionals, and operations teams all influence how accounts are created, permissions are assigned, vendors are approved, and employees respond to suspicious requests. Cybersecurity decisions now affect daily law firm operations as directly as accounting systems, staffing procedures, and document management.

What Phishing-Resistant MFA Does Differently

Phishing-resistant MFA reduces the chance that an employee can be tricked into revealing a usable authentication factor. Instead of relying on a code that can be copied or an approval prompt that can be accepted, it uses authentication methods tied to the legitimate website or device.

Passkeys are one example. They use cryptographic credentials stored on a trusted device and can verify that the user is signing in to the real service rather than a fraudulent copy. Hardware security keys work in a similar way by requiring possession of a physical device that communicates with the legitimate login system.

This matters because an attacker can reproduce the appearance of a Microsoft sign-in page, but they can’t make a phishing site behave like the real Microsoft domain during a phishing-resistant authentication exchange. If the domain doesn’t match, the authentication attempt fails instead of handing the attacker a reusable code.

Law firms don’t need to replace every authentication method at once. A practical starting point is to prioritize accounts with elevated privileges, financial authority, access to sensitive client information, or responsibility for IT administration. From there, the firm can expand phishing-resistant MFA to other users while retiring weaker options such as SMS codes and simple push approvals where possible.

What Law Firm Managers Should Review Now

A law firm’s MFA settings shouldn’t be treated as a one-time IT project. Authentication methods, account privileges, employee roles, and cyber threats change. TLOMA members can help by making identity security part of regular operational reviews with internal IT teams or managed service providers.

Review Current MFA Methods

Start by asking which MFA methods your firm currently permits. If employees can still authenticate through SMS codes, voice calls, or basic push notifications, determine where stronger options can replace them.

Create an Action Plan

Your firm should know who can revoke active sessions, reset credentials, disable an account, review sign-in activity, and preserve records for investigation. Changing a password may not end an attacker’s access if a stolen session token remains active.

Conduct Employee Training

Staff should know that an unexpected MFA prompt can indicate that someone already has their password. They should report unexplained authentication requests rather than approve them, and IT staff should verify identity before resetting credentials or changing authentication methods.

Review Account Permissions

Employees should have access only to the systems and information required for their jobs. When someone changes roles or leaves the firm, permissions should be updated promptly. Limiting account privileges can reduce how far an attacker can reach if one login is compromised.

MFA Is One Part of Identity Security

MFA remains an important safeguard, but Ontario law firms need to look beyond the simple question of whether it has been enabled. The better question is which authentication methods your firm uses, which accounts have the greatest access, and how quickly your team can respond when a login attempt looks suspicious.

Phishing-resistant MFA can reduce the risk posed by stolen passwords, fake login pages, MFA fatigue, and intercepted authentication sessions. Pairing it with tighter permissions, sign-in monitoring, employee training, and a tested response plan gives your firm a stronger defence against account takeover. If your firm hasn’t reviewed its MFA configuration recently, now is a good time to find out where weaker authentication methods remain and which accounts should be upgraded first.

Nolan is an expert in IT for law firms. In 2024 he became CEO of IT support company Inderly, local to Hamilton and Toronto and serving law firms across Ontario.  

When not leading the Inderly team, Nolan can usually be found writing and shooting independent films, playing D&D, or enjoying Toronto’s best theatre productions and concerts.