Your MFA Isn't Enough Anymore — The 3-Layer Defence Stack That Actually Stops Modern Attackers
TL;DR
- The CyberCX 2026 Threat Report confirms cyber extortion has overtaken business email compromise as the #1 type of cyber incident — attackers are inside your network for an average of 68 days before you notice [1]
- Multi-factor authentication (MFA) is being bypassed at scale via adversary-in-the-middle (AiTM) session hijacking, which steals your session after you've already authenticated — your password and MFA code never even get tested [1][3]
- Financial services is now the most impacted sector, but stolen credentials are the #1 entry point across every industry — meaning any business holding valuable data or payment info is in the crosshairs [1][5]
- The fix isn't more complexity — it's layering three specific defences that close the gaps MFA alone leaves open
Why "We Have MFA" Is No Longer Enough
If you've been thinking "we've got multi-factor authentication turned on, we're sorted" — you're not alone. Most business owners were told exactly that by their IT provider five years ago. And five years ago, it was largely true.
Get Our Weekly Cybersecurity Digest
Every Thursday: the threats that matter, what they mean for your business, and exactly what to do. Trusted by SMB owners across Australia.
No spam. No tracking. Unsubscribe anytime. Privacy
The threat has evolved. According to the CyberCX 2026 Threat Report, which analysed more than 100 serious cyber incidents handled by their Digital Forensics and In
Free Resource
Get the Free Cybersecurity Checklist
A practical, no-jargon security checklist for Australian businesses. Download free — no spam, unsubscribe anytime.
Send Me the Checklist →Here is how it works. When you log in to a service and pass your MFA challenge, your browser receives a session token — a small file that tells the website "this person authenticated successfully." AiTM phishing kits sit between you and the real website in real time, capturing that session token the moment you log in. From that point, the attacker has a valid, authenticated session. Your MFA code was real, your password was real, but the attacker never needed either of them after login [3].
The CyberCX report links the rise of AiTM attacks to the broader availability of low-cost phishing-as-a-service kits, which have reduced the technical skill needed to run large-scale campaigns. This is not a nation-state threat reserved for governments — it is a commodity attack available to any financially motivated criminal for a monthly subscription [1][7].
Related: How AI-Powered Phishing Has Changed the Game for SMBs
The Numbers That Should Change How You Invest in Security
The 2026 CyberCX data tells a clear story about what is actually happening in Australian and New Zealand businesses right now [1]:
Detection time has more than doubled. The median time for a financially motivated attacker to be detected inside an environment was 68 days in 2025 — up from 24 days in 2024. Attackers are taking longer to move, behaving like legitimate users to avoid triggering alerts [1].
Financial services is now #1. Financial and insurance services accounted for approximately one in five incidents CyberCX responded to — overtaking healthcare for the first time. The pattern follows the data: wherever high-value financial or personal information is processed, criminals follow [1].
Nearly 60% of attacks are financially motivated. Almost six in ten incidents were attributed to criminals seeking payment — not espionage, not hacktivism, not disruption for its own sake. Your business is a revenue target [1].
Stolen credentials remain the master key. Across cyber extortion incidents, valid accounts obtained through information stealers and social engineering were the most common initial access technique. This directly echoes Verizon's 2025 Data Breach Investigations Report, which found that credential compromise is the entry vector in the majority of breaches [5].
According to IBM's 2025 Cost of a Data Breach Report, the average breach now costs organisations USD $4.88 million globally — and small-to-medium businesses disproportionately bear the long-term cost because they lack the recovery resources of enterprise [6].
What Attackers Do With 68 Days Inside Your Network
Sixty-eight days is not a data-dumping sprint. That dwell time tells you something important: modern attackers are patient, and they are not just after your data on day one.
The CyberCX 2026 report describes a shift in how ransomware groups apply pressure during double extortion attacks — where data theft accompanies encryption. In more than a third of double extortion attacks, threat actors did not immediately advertise stolen data on their leak site (up from less than 10% the previous year) [1]. This is a deliberate psychological tactic: the threat of exposure is kept live as ongoing leverage.
During those 68 days, a financially motivated attacker may be:
- Mapping your network — identifying which systems are most valuable to encrypt or exfiltrate
- Harvesting credentials — collecting usernames and passwords from memory, browser stores, and credential managers
- Establishing persistence — creating hidden admin accounts, scheduled tasks, or backdoors to maintain access even if discovered
- Identifying your backup systems — because encrypting your primary systems while leaving a clean backup reduces their leverage
The Microsoft Digital Defense Report 2025 notes that attackers increasingly use legitimate IT tools and "living off the land" techniques — using your own software against you, which makes detection through traditional antivirus almost impossible [8].
Related: 67% of Breaches Start With a Stolen Login
ISO 27001 SMB Starter Pack — $97
Everything you need to start your ISO 27001 journey: gap assessment templates, policy frameworks, and implementation roadmap built for Australian SMBs.
Get the Starter Pack →The 3-Layer Defence Stack That Closes These Gaps
This is not about buying more tools. It is about building three overlapping layers that each independently stop a different phase of the attack chain described above. The CyberCX 2026 report, the NIST Digital Identity Guidelines (SP 800-63B), and CISA's phishing-resistant MFA guidance all point to the same framework [1][4][9].
Layer 1 — Credential Hygiene
The first and most important layer. If attackers cannot get valid credentials, AiTM has nothing to capture.
What this means for your business:
- Deploy a password manager and enforce unique passwords across every service — credentials reused from other breaches are a critical exposure
- Enable breach monitoring so you are alerted when your employees' email addresses appear in dark web credential dumps (tools like Have I Been Pwned Enterprise, or your Microsoft 365 subscription includes this in some plans)
- According to the ASD Annual Cyber Threat Report 2023-24, credential stuffing — using credentials stolen from one breach to access other services — is responsible for a significant proportion of initial access events affecting Australian organisations [2]
Layer 2 — Phishing-Resistant Authentication
Standard MFA (SMS, authenticator app codes) is vulnerable to AiTM. Phishing-resistant MFA is not — because it cryptographically binds the authentication to a specific origin domain, making intercepted tokens useless to an attacker on a different domain.
What this means for your business:
- Move your highest-value accounts (finance, admin, IT) to FIDO2/passkeys or hardware security keys (YubiKey-style devices). These cannot be phished or replayed because the credential is tied to the specific website domain [4]
- For accounts that cannot yet use passkeys, use Microsoft Authenticator with number matching or Google Prompt with device approval — these are harder to bypass than simple TOTP codes
- CISA's Phishing-Resistant MFA guidance (2023) recommends FIDO2 as the gold standard for all privileged access [4]
Layer 3 — Session and Behaviour Monitoring
Even if an attacker bypasses layers one and two via AiTM, session monitoring catches the anomaly: a valid session being used from an unexpected location, device, or time.
What this means for your business:
- Enable conditional access policies in Microsoft 365 or Google Workspace — these can block sessions from unrecognised devices or locations, even when the authentication token is valid
- Implement User and Entity Behaviour Analytics (UEBA) if your budget allows — tools like Microsoft Sentinel (included in some M365 E5 plans) flag when account behaviour suddenly changes
- Review your sign-in logs monthly — suspicious IP addresses, unusual login times, or logins from countries you don't operate in are early warning signs
- The ReliaQuest 2026 Annual Cyber Threat Report recommends reducing session token lifetimes for sensitive applications, which limits how long a stolen token remains useful to an attacker [10]
The Business Case: What Getting This Right Actually Saves You
Let's translate this to money, because that is the real conversation.
The average ransomware recovery for an SMB in 2025 ran between AUD $250,000 and $1.2 million when total costs are accounted for — ransom payment (if made), forensics, legal fees, regulatory notifications, and lost productivity [1][6]. That is before reputational damage or customer churn.
The 3-Layer Defence Stack above can be implemented in a staged approach. Layer 1 (credential hygiene) is achievable for most businesses within 30 days at low or zero incremental cost if you already have a Microsoft 365 subscription. Layer 2 (phishing-resistant MFA) requires hardware keys for admin accounts — budget approximately $30–80 per key, amortised over 3–5 years. Layer 3 (session monitoring) can be activated within existing Microsoft or Google enterprise plans.
Security is not an insurance grudge-purchase. When your systems stay online, your team stays productive, your clients stay trusting, and your business keeps running. That is what this investment protects.
FAQ
Normal phishing steals your username and password. AiTM phishing goes one step further — it acts as a live proxy between you and the real website, capturing your valid session token after you've already completed MFA. The attacker never needs your password at all; they just replay the session token. This is why standard MFA does not stop it.
Cyber extortion is the broader category. Traditional ransomware encrypts your files and demands payment for the decryption key. Modern cyber extortion adds a second layer — the attacker also steals copies of your data and threatens to publish it unless you pay, even if you restore from backups. The CyberCX 2026 report calls this "double extortion" and notes that in over a third of cases, the threat was held in reserve rather than immediately published, extending the pressure on victims.
Almost certainly not — most cyber extortion attacks are opportunistic, not targeted. Attackers scan the internet for exposed services, weak credentials, and unpatched systems, then automate the breach process. Small businesses are attractive precisely because they typically have fewer defences. The ASD's Annual Cyber Threat Report confirms that small businesses are disproportionately impacted relative to their defences [2].
Enable a password manager and enforce unique passwords across every business account. Credential reuse is the most common initial access vector across cyber extortion incidents. This alone closes a significant percentage of the attack surface. It is free with tools like Bitwarden (free tier) or included in some Microsoft 365 plans.
Use Have I Been Pwned to check individual email addresses at no cost. For business-wide monitoring, Microsoft 365 Business Premium and Entra ID P2 both include dark web credential monitoring. Enterprise options like Black Kite or SpyCloud offer comprehensive monitoring — Black Kite's 2026 Third-Party Breach Report found that 62% of the top shared vendors among large organisations had corporate credentials exposed in stealer logs [3].
References
[1] CyberCX, "CyberCX 2026 Threat Report," CyberCX, Mar. 2026. [Online]. Available: https://cybercx.com.au/resources/
[2] Australian Signals Directorate, "ASD Annual Cyber Threat Report 2023-24," Australian Signals Directorate, 2024. [Online]. Available: https://www.cyber.gov.au/about-us/view-all-content/reports-and-statistics/asd-cyber-threat-report-july-2023-june-2024
[3] The Hacker News, "Starkiller Phishing Suite Uses AiTM Reverse Proxy to Bypass MFA," The Hacker News, Mar. 2026. [Online]. Available: https://thehackernews.com/2026/03/starkiller-phishing-suite-uses-aitm.html
[4] CISA, "Implementing Phishing-Resistant MFA," Cybersecurity and Infrastructure Security Agency, 2023. [Online]. Available: https://www.cisa.gov/resources-tools/resources/phishing-resistant-mfa
[5] Verizon, "2025 Data Breach Investigations Report," Verizon Business, 2025. [Online]. Available: https://www.verizon.com/business/resources/reports/dbir/
[6] IBM Security, "Cost of a Data Breach Report 2025," IBM, 2025. [Online]. Available: https://www.ibm.com/reports/[data-breach](https://lil.business/blog/ransomware-backup-dual-extortion-smb-recovery-stack-2026/)
[7] SecurityBrief Australia, "Cyber extortion tops 2025 attacks as AI risks escalate," SecurityBrief AU, Mar. 3, 2026. [Online]. Available: https://securitybrief.com.au/story/cyber-extortion-tops-2025-attacks-as-ai-risks-escalate
[8] Microsoft, "Microsoft Digital Defense Report 2025," Microsoft Security, 2025. [Online]. Available: https://www.microsoft.com/en-us/security/security-insider/microsoft-digital-defense-report-2025
[9] NIST, "SP 800-63B: Digital Identity Guidelines — Authentication and Lifecycle Management," National Institute of Standards and Technology, 2024. [Online]. Available: https://pages.nist.gov/800-63-4/sp800-63b.html
[10] ReliaQuest, "2026 Annual Cyber Threat Report," ReliaQuest, 2026. [Online]. Available: https://reliaquest.com/campaigns/annual-threat-report-2026/
Is your MFA configuration actually phishing-resistant? Most businesses don't know until they're tested. Book a free security posture review with lilMONSTER — we'll map your current authentication gaps and give you a prioritised fix list, no obligation.
Work With Us
Ready to strengthen your security posture?
lilMONSTER assesses your risks, builds the tools, and stays with you after the engagement ends. No clipboard-and-leave consulting.
Book a Free Consultation →Your Business Lock Just Got Picked — And Your Alarm Code Didn't Help
Explained Like You're 10
TL;DR
- Hackers have figured out how to let you unlock your own door — and then sneak in behind you, even with a two-step security code
- A new report found that criminals spend an average of 68 days hiding inside a business's systems before being caught [1]
- There are three simple improvements that close these gaps — and most businesses can start today
Your Digital Front Door Has a New Problem
Imagine you have a house with a really good lock. To get in, you need both a key and a secret code you get on your phone. This is basically what "multi-factor authentication" (MFA) is — two things to prove it's really you.
For years, that was great protection. But criminals figured out a clever trick.
The trick: They set up a fake copy of your front door, right in front of the real one. When you unlock the real door and enter your code, they're watching — and they quickly grab an invisible copy of your "this person is already inside" wristband before you even notice. Then they walk into your real house using that copy wristband, even though they never had your key or your code.
That's what security experts call an adversary-in-the-middle attack. Your alarm code still worked. You did everything right. They got in anyway.
What's Actually Happening Out There
A company called CyberCX looked at more than 100 real cyberattacks they helped businesses recover from in 2025 [1]. Here's what they found:
Criminals are hiding for almost 3 months. The average time between "criminal gets in" and "business notices something is wrong" was 68 days in 2025 — up from 24 days the year before. That's like having an uninvited guest living in your attic for two months while you go about your normal life.
Money-focused criminals are the biggest threat. Almost 6 out of every 10 attacks were by people just trying to steal money — not governments, not spies, just criminals treating your business like a piggy bank.
Banks and finance companies are now #1 target. About 1 in every 5 attacks CyberCX responded to hit a financial or insurance business. That's because wherever money data lives, criminals follow.
What Criminals Do With 68 Days of Hiding
This is the part most people don't think about.
If a criminal gets into your business systems and you don't notice for 68 days, they're not just sitting there doing nothing. Think of it like a very patient burglar who got into your shop after closing:
- Week 1-2: They're quietly exploring. Finding where you keep the valuables, mapping out every room.
- Week 3-6: They're copying files. Customer records. Financial data. Staff details.
- Week 7-10: They're setting up ways to stay even if you change the locks.
Then on day 68 — or whenever they feel ready — they flip the switch. They lock you out of your own systems and demand payment to let you back in. And they tell you they've also made a copy of everything they found, and they'll publish it publicly unless you pay extra.
This is called cyber extortion, and according to CyberCX, it's now the most common type of cyberattack businesses face [1].
The 3 Things That Actually Fix This
Think of these as three overlapping safety nets. Each one stops a different part of the attack.
Safety Net 1: Better Passwords (Stop Them Getting In)
The most common way criminals get their initial access is through stolen passwords — often ones leaked from a completely different website you signed up to years ago. They try that same password on your business email, and it works.
What to do:
- Use a password manager (like Bitwarden — free, or the one built into your iPhone/Android) so every account has a unique, random password
- If you're a Microsoft 365 business, check if your admin account has "Entra ID" breach alerts turned on
- This one change closes the door for most entry attempts
Safety Net 2: The Right Kind of Two-Factor Login (Stop Them Faking You)
Not all two-step logins are equal. The old style (a code sent to your phone) can be intercepted by the wristband trick we described earlier. The new style, called passkeys or FIDO2, can't be copied — it's mathematically tied to the exact website you're logging into, so a fake site can never get a usable copy.
What to do:
- Turn on passkeys for your most important accounts (Google, Microsoft, and major banks all support them now)
- For accounts that don't support passkeys yet, use an app-based authenticator (Microsoft Authenticator or Google Authenticator) rather than SMS codes
- Budget $30–80 per hardware security key if you have staff who access sensitive admin systems
Safety Net 3: Watch for Weird Behaviour (Catch Them If They Sneak In)
Even if a criminal gets past the first two nets, you can still catch them because they'll behave differently to your normal staff.
What to do:
- In Microsoft 365 or Google Workspace, look in your admin panel for "sign-in risk alerts" or "suspicious activity" — these are often already turned on, just not being checked
- Set up a rule that blocks logins from countries you don't do business in
- Once a month, spend 10 minutes looking at your admin account's recent login history — an unexpected location or 3am login is a red flag
What This Saves You
The average cost of recovering from a cyber extortion attack for a small business runs into the hundreds of thousands of dollars — forensics, legal fees, staff overtime, lost customers, and sometimes the ransom itself [6].
The three safety nets above? They can be set up in stages. The first one (password manager) is free. The second (passkeys) costs nothing for consumer-grade accounts. The third (monitoring) is already included in most business Microsoft 365 or Google Workspace subscriptions — you just have to turn it on.
A fitness trainer doesn't make you weak — they make you harder to knock over. That's exactly what this does for your business. You keep running, your clients stay protected, and criminals move on to easier targets.
FAQ
Yes, absolutely — it still stops the vast majority of attacks. The wristband trick we described requires a lot of extra effort by the attacker. MFA is still an important layer. The point is that it should not be your only layer, and where possible, upgrading to passkeys is worth it.
Most attacks are automated — criminals run software that scans millions of businesses at once looking for open doors. They're not targeting you specifically; they're targeting anyone who hasn't locked their door. Small businesses often have less protection, which ironically makes them more common targets, not less [2].
Cyber extortion is when a criminal gets into your systems, locks you out, and demands payment — like changing the locks on your own business and leaving a note saying "pay us to get the key back." Modern versions add a threat to publish your confidential data publicly if you don't pay.
Visit haveibeenpwned.com and enter your business email addresses. If they appear in known breaches, change those passwords immediately. For ongoing monitoring, check if your Microsoft 365 subscription includes dark web credential alerts.
Open your password manager (or download a free one like Bitwarden), change your business email and banking passwords to unique randomly-generated ones, and turn on an authenticator app. This takes about 20 minutes and closes the single biggest door criminals use.
References
[1] CyberCX, "CyberCX 2026 Threat Report," CyberCX, Mar. 2026. [Online]. Available: https://cybercx.com.au/resources/
[2] Australian Signals Directorate, "ASD Annual Cyber Threat Report 2023-24," Australian Signals Directorate, 2024. [Online]. Available: https://www.cyber.gov.au/about-us/view-all-content/reports-and-statistics/asd-cyber-threat-report-july-2023-june-2024
[3] CISA, "Implementing Phishing-Resistant MFA," Cybersecurity and Infrastructure Security Agency, 2023. [Online]. Available: https://www.cisa.gov/resources-tools/resources/phishing-resistant-mfa
[4] The Hacker News, "Starkiller Phishing Suite Uses AiTM Reverse Proxy to Bypass MFA," The Hacker News, Mar. 2026. [Online]. Available: https://thehackernews.com/2026/03/starkiller-phishing-suite-uses-aitm.html
[5] Verizon, "2025 Data Breach Investigations Report," Verizon Business, 2025. [Online]. Available: https://www.verizon.com/business/resources/reports/dbir/
[6] IBM Security, "Cost of a Data Breach Report 2025," IBM, 2025. [Online]. Available: https://www.ibm.com/reports/data-breach
[7] SecurityBrief Australia, "Cyber extortion tops 2025 attacks as AI risks escalate," SecurityBrief AU, Mar. 3, 2026. [Online]. Available: https://securitybrief.com.au/story/cyber-extortion-tops-2025-attacks-as-ai-risks-escalate
[8] Microsoft, "Microsoft Digital Defense Report 2025," Microsoft Security, 2025. [Online]. Available: https://www.microsoft.com/en-us/security/security-insider/microsoft-digital-defense-report-2025
Not sure if your business authentication is actually secure? Book a free 30-minute security review with lilMONSTER and we'll check your setup together — plain English, no jargon, no sales pitch.
