According to Simmons University’s notice reflected in the Massachusetts AG sample filing associated with 13 February 2025, an employee clicked a phishing link framed as a health advisory, entered login credentials, and approved a fraudulent MFA request. Attackers then accessed that employee’s Simmons Workday account. Phishing-proof MFA 2.0 would have blocked that credential-phase path because there is no password to harvest and no MFA prompt a person can approve for an attacker. Once login already completed, Workday access is post-authentication containment, not another login factor.
For the full attack-chain narrative, read the companion on legacymfa.sucks.
FAQ
Would phishing-proof MFA have stopped the Simmons Workday phishing path?
Yes. Phishing-proof MFA 2.0 would have stopped the Simmons University credential-phase path the notice describes. The employee submitted login credentials and approved a fraudulent MFA request after a health-advisory phishing lure. Device-bound MFA 2.0 has no reusable secret to type and no transferable approval challenge, so that lure cannot finish workforce sign-in. Closing the phishable login stops this path. Malware after a legitimate login is a harder, separate problem.
Why did legacy MFA fail when the employee approved a fraudulent request?
Legacy MFA failed in the Simmons University incident because the second factor was still something a human could approve under a phishing lure. According to the Massachusetts AG sample notice, credential entry and a fraudulent MFA approval came before Workday access. Public reporting does not name the exact MFA method. OTP, SMS, email codes, and push-style approvals all stay phishable. That is why legacy MFA was dropped as a control class for this failure mode.
Does MFA 2.0 undo Workday access after attackers already signed in as the employee?
No. MFA 2.0 does not undo Simmons Workday access after attackers already completed login as the employee. Prevention applies only to blocking the earlier authentication abuse. Public reporting does not establish session-cookie theft, device-code phishing, or an AiTM reverse proxy in this incident. After a completed workforce session, defenders still need revoke, access review on HR and payroll systems, and endpoint hygiene. Login cryptography cannot rewind a session that already existed.
How should higher-ed teams treat passkeys versus MFA 2.0 after Simmons?
Passkeys are phishing-resistant at the login ceremony. MFA 2.0 is phishing-proof across the identity lifecycle. For the Simmons University pattern, the documented failure was a phishable password plus a fraudulent MFA approval on a workforce path to Workday. Origin-bound device credentials remove both the secret to type and the prompt to approve. If enrollment or recovery still uses email codes, SMS, or helpdesk-read secrets, resistant login alone can leave a lifecycle gap. Full-lifecycle coverage is what phishing-proof MFA adds beyond resistant login.
What is the durable fix for Simmons-style Workday phishing?
The durable fix is to remove phishable workforce secrets and approvable MFA from HR and payroll logins, not to retrain staff to spot every health-advisory lure. Simmons University’s path succeeded because credentials and an MFA approval could still complete authentication. Prevention, not detection, is the design goal: the attacker never obtains a finished sign-in. Public reporting does not establish an affected record count; the notice frames payroll and HR data exposure risk from the employee Workday account.
