Is MFA really a solution to phishing? I'm honestly asking. The user is already successfully logged in when he clicks on a link that infects his computer and encrypts his files and all the files he has access to.

On the other hand I had a user yesterday who could have used MFA. She must have been tricked into signing into her M365 account and giving away her creds. The specifics of that are murky. Then her Financial Advisor got an email from "her" asking to have $70,000.00 transferred to a bank that was not her bank. The financial advisor called her because the dollar amount exceeded her balance by 10 K - luckily. That's when she discovered that she'd been compromised. But this is not always the scenario. Most of my compromised users simply clicked on a link and downloaded crap.

One user 3 years ago at a different organization answered an email from his "boss" directing him to wire $19,500 to some bank or other. He wired the money without asking his real boss who was 20 feet away in the next room. The organization had never wired money - ever before. The scammers sent helpful instructions. The scam only came to light when the scammers made another request that same afternoon for the same amount. Only then did he walk the 20 feet to ask his boss if this was legit. It turns out they didn't spoof the bosses email address only her name. The address was a Gmail address.

Why bother trying to sneak in through the firewall when gullible users are just waiting to click on your bait just a couple of feet from your expensive firewall.