In September 2026, researchers at CloudSEK published what they found inside a phishing operation called BigBear 2.0, after getting into its control panel. The kit had been pointed at 461 organizations in more than 40 countries. At 258 of them it walked past multifactor authentication and collected 5,137 sets of credentials along the way. Every one of those companies had MFA turned on.

One detail matters more than the numbers. The kit injected code into the victim’s browser to switch off passkeys, so the sign-in would fall back to a text code or an app prompt it could relay. The attackers had to sabotage passkeys to make the attack work. That is the whole case for them, in one sentence.

So the question for an owner is not “do we have MFA.” It is “is ours the kind this kit beats.” Most small companies do not know. This guide is how to find out, and what to do about the answer.

Not all MFA is equal

There are three kinds of second step in common use at small companies, and a fake sign-in page treats each differently.

A code sent by text message. The fake page asks for the code, the user types it, and the attacker relays it to the real site within seconds. The phone number can also be stolen outright at a carrier store. Microsoft is retiring its own text and voice codes on February 1, 2027 for exactly this reason; our guide on Microsoft retiring SMS and voice MFA covers the dates.

An app prompt. Better, because there is no code to type. But a fake page can start a real sign-in in the background, and the genuine “approve this?” prompt lands on the user’s phone while they are looking at the fake page. They approve what appears to be their own login. Number matching, where the user types two digits from the screen into the app, makes this harder but not impossible when the attacker’s page is showing the real numbers it just received.

A passkey. The key is tied to the real website’s address. A fake page at a different address cannot ask for it, and there is nothing to type or approve on the wrong screen. That is the property the BigBear operators had to disable. NIST, the federal standards body, calls this phishing resistant, and its current password guidance treats it as the destination; we cover that in our guide on the updated NIST password guidelines.

What a passkey is, in plain English

A passkey is a digital key stored on something the person already has: their Windows PC through Windows Hello, their phone through Microsoft Authenticator, or a small USB or NFC security key. To sign in, they unlock the key the way they unlock the device, with a fingerprint, face, or PIN. Nothing is remembered, nothing is typed into a page, and nothing travels that an attacker could intercept.

For the person using it, this is faster than waiting for a text. That is the part to lead with when you tell staff. The security argument is for you; the convenience argument is for them.

Why Microsoft is pushing now

Passkeys became the default sign-in method for Microsoft 365 on September 1, 2026. Since then, anyone who still uses text or voice codes has been getting a prompt to register one. On February 1, 2027 Microsoft stops sending its own codes, and a user whose only method is text or voice will not be able to sign in until a passkey exists.

The push has a business reason as well as a security one. Phishing kits like BigBear are sold as a service, with a control panel and customer support, to people who could not build one. The weak second step is now an industrial target, not a clever trick, and Microsoft would rather remove it than keep patching around it.

What counts as a passkey in a Microsoft 365 company

Four things, all of which Microsoft Entra accepts:

  1. Windows Hello for Business on a company PC. The machine itself becomes the key, unlocked with the camera, fingerprint reader, or a PIN that never leaves the device. Most company laptops built in the last five years can do this.
  2. A passkey in Microsoft Authenticator on the person’s phone. This is different from the tap-to-approve prompt in the same app. It is a setting, and people who already have Authenticator can add it in a minute.
  3. A hardware security key, a small USB or NFC device. The answer for shared workstations, warehouse and front-desk roles, and anyone without a smartphone.
  4. A synced passkey in iCloud Keychain or Google Password Manager, which follows the person across their personal devices.

The honest caveat concerns the fourth. A synced passkey is only as well protected as the personal Apple or Google account it lives in, and it can be shared to another device with a tap. For personal accounts that trade-off is fine. For company accounts we recommend the first three by default, and an administrator can set the tenant to accept only those. The decision belongs in your policy, not in each employee’s phone settings.

A rollout order for 30 people

  1. Get the count. Microsoft publishes a report listing every user still on text or voice codes. Ask whoever runs your IT for the number. If they cannot produce it in a day, that is your first finding.
  2. Owners and administrators first. These are the accounts the kit is aimed at, and the ones whose compromise costs the most. Do them this week.
  3. Then the people who move money. Accounts payable, payroll, anyone who approves a wire or changes a vendor’s bank details. Invoice fraud starts with one of these mailboxes.
  4. Everyone with a company Windows PC gets Windows Hello. This is mostly a policy switch, and staff notice only that signing in got faster.
  5. Everyone with a phone adds a passkey in Authenticator. Two methods per person is the goal, so a lost device is an inconvenience and not a lockout.
  6. The edge cases get a named owner. Shared machines, the person with a flip phone, the service account that sends invoices. Each gets a hardware key or a documented exception, decided on purpose.
  7. Turn the weak methods off. This is the step companies skip, and it undoes the rest. A passkey sitting beside a text code is a passkey the attacker routes around, which is exactly what BigBear did. Once someone has two strong methods registered, remove text and voice from their account. For the accounts in steps 2 and 3, have your IT person require the phishing-resistant method outright, so the fallback does not exist.

The whole sequence for a 30-person company is a few hours of administration and a two-paragraph email to staff. The email matters: a user who expects the prompt registers; a user surprised by it calls the help desk or ignores it as a scam.

What if we cannot move everyone?

Some workflows genuinely need a text or a call, usually because a regulator or a legacy system says so. Microsoft has an answer, and it is an honest one: you can keep text codes by contracting your own telecom provider through the Microsoft Security Store. Microsoft published the provider details and pricing on September 18, 2026, and tenants can configure a provider from October 30, 2026. You pay the provider per message.

Treat that as an exception path, documented and scoped to the smallest possible group. Paying a carrier every month to keep the method a phishing kit is built to beat is a strange place to spend money when the fix is included in what you already own.

What a well-run passkey rollout looks like

  1. A count you can quote. How many people still sign in with a text code, as a number, today.
  2. Owners, admins, and the finance team already moved, with the weak methods removed from those accounts, not just supplemented.
  3. Two strong methods per person, typically Windows Hello plus Authenticator, so nobody is one lost phone from a lockout.
  4. A policy line saying which kinds of passkey the company accepts, and the tenant configured to match it.
  5. A named owner for the exceptions, and a date by which each one is either moved or documented.
  6. February 1, 2027 treated as a formality, because nobody is left for the deadline to catch.

Where this leaves you

Two questions to put to whoever runs your technology this week. “Which of our sign-in methods would the BigBear kit have beaten?” and “How many of our people are still on one of those?” If the answer to the second is a number and a date, you are in good shape. If it is “everyone has MFA,” you have found the gap.

Everything above is configuration of things a Microsoft 365 Business Premium tenant already includes. When a company wants the count run, the rollout staged, and the stragglers handled, that is what our Microsoft 365 management and cybersecurity services do. Get in touch and we will start with the number.