For most defenders, a phishing alert ends with a forced password change. Mirage2FA is built to make that response useless.