We just experienced a successful phishing attack even with MFA enabled.

One of our user accounts just nearly got taken over. Fortunately, the user felt something was off and contacted support.

The user received an email from a local vendor with wording that was consistent with an ongoing project.
It contained a link to a "shared document" that prompted the user for their Microsoft 365 password and Microsoft Authenticator code.

Upon investigation, we discovered a successful login to the user's account from an out of state IP address, including successful MFA. Furthermore, a new MFA device had been added to the account.

We quickly locked things down, terminated active sessions and reset the password but it's crazy scary how easily they got in, even with MFA enabled. It's a good reminder how nearly impossible it is to protect users from themselves.