AI Is Making Fake Login Pages Harder to Spot, and MFA Alone May Not Stop Them

Fake login pages are an old trick, but generative AI is making them faster to build and more believable. Attackers can copy company logos, page layouts and login prompts so closely that the pages resemble the sites employees use every day. AI also helps tailor messages to specific organisations or staff, such as a personalised IT notification that sends an employee to a fraudulent page carrying the company's own branding.

These attacks often use lookalike domains, which are web addresses with subtle spelling changes or extra characters. Combined with realistic pages and targeted messages, they are harder to recognise. The 2026 Verizon Data Breach Investigations Report found that phishing accounted for 44% of the AI-assisted initial-access techniques it examined.

The risk goes beyond stolen passwords. Some fake pages copy multi-step sign-in processes to collect MFA codes, which attackers may try to use before they expire. More advanced attacks use Adversary-in-the-Middle (AiTM) techniques, where a fraudulent site acts as a go-between for the user and the real service. After the user signs in successfully, the attacker may capture a session cookie or token and access the account without facing another MFA prompt.