MFA Isn’t Invincible: How Cybercriminals Are Bypassing Multi-Factor Authentication

 

Introduction

For years, Multi-Factor Authentication (MFA) has been one of the strongest recommendations in cybersecurity. Adding a second verification step makes it significantly harder for attackers to take over an account using only a stolen password.

But MFA is not a magic shield.

Cybercriminals have adapted. Instead of simply trying to steal passwords, attackers increasingly target the authentication process itself. They use phishing, social engineering, session theft, push-bombing, and other techniques to trick users or capture authenticated sessions.

This does not mean MFA is useless. Quite the opposite: MFA remains an important security control. The problem is that not all MFA methods provide the same level of protection.

In April 2026, the UK's National Cyber Security Centre (NCSC) announced that it would recommend passkeys wherever services support them, stating that FIDO2 credentials, including passkeys, provide protection that is as strong or stronger than traditional MFA against common credential attacks. (National Cyber Security Centre)

At OSMALLAMINTECH, we believe cybersecurity awareness must evolve alongside the threats. Understanding how attackers bypass conventional MFA is the first step toward adopting stronger, phishing-resistant authentication.

What Is Multi-Factor Authentication?

MFA requires users to provide more than one form of verification before accessing an account.

Authentication factors generally fall into categories such as:

• Something you know: password or PIN

• Something you have: phone, security key, or authentication device

• Something you are: fingerprint or facial recognition

For example, logging into an account with a password and then approving an authentication request provides an additional layer of protection compared with password-only authentication.

However, the security of MFA depends heavily on how the second factor is implemented.

Why MFA Can Still Be Bypassed

Traditional MFA methods can still be vulnerable to phishing and real-time interception.

The NCSC's 2026 assessment found that traditional MFA methods including SMS codes, email codes, authenticator-generated one-time passwords, and push approvals remain susceptible to phishing because attackers may observe or relay the authentication information during a live attack. (National Cyber Security Centre)

Attackers therefore increasingly ask:

"How do I get around MFA?"

rather than:

"How do I steal the password?"

1. MFA Fatigue and Push Bombing

One of the simplest techniques is MFA fatigue.

An attacker obtains a victim's username and password and repeatedly sends authentication requests to the victim's device.

The victim may receive:

"Approve sign-in?"

again and again.

Eventually, the user may approve the request simply because they are tired, confused, or believe the notifications are caused by a technical problem.

The attacker then gains access.

How to defend against it

• Never approve an authentication request you did not initiate.

• Report unexpected MFA notifications.

• Use number matching where supported.

• Investigate repeated authentication attempts.

• Prefer phishing-resistant authentication such as passkeys or FIDO2 security keys.

2. Adversary-in-the-Middle (AiTM) Attacks

An Adversary-in-the-Middle attack places the attacker between the victim and the legitimate authentication service.

The victim may be directed to what appears to be a legitimate login experience.

The attacker can relay the authentication process in real time and potentially capture credentials or session information.

This is especially dangerous because the victim may successfully complete MFA while the attacker obtains an authenticated session.

Government cybersecurity guidance has specifically identified phishing-resistant MFA as a key defense against AiTM attacks. (Canadian Centre for Cyber Security)

3. Session Cookie Theft

Sometimes attackers do not need to steal the password or MFA code at all.

They target the authenticated session.

After a legitimate login, a browser may receive a session cookie or authentication token that tells the service:

"This user has already authenticated."

If an attacker steals that session information, they may be able to impersonate the user without repeating the original MFA process.

This technique is particularly relevant to infostealer malware, which can target browser credentials and session data. (Huntress)

This creates an important lesson:

MFA protects authentication but an already authenticated session still needs protection.

4. SIM Swapping

SMS-based MFA can be targeted through SIM swapping.

An attacker attempts to convince a mobile carrier to transfer a victim's phone number to a SIM card controlled by the attacker.

If successful, SMS authentication codes may be redirected to the attacker.

This is one reason organizations are increasingly moving toward authentication methods that do not depend on SMS.

Microsoft's current Entra transition explicitly positions passkeys as phishing-resistant and resistant to SIM-swap and replay attacks. (Microsoft Learn)

5. Device-Code Phishing

Another emerging technique abuses legitimate device authorization workflows.

Attackers may persuade victims to enter or approve a code on a legitimate authentication service while believing they are completing a normal login or setup process.

If the victim completes the process, the attacker may obtain authorization for their own session.

The broader lesson is important:

Legitimate authentication infrastructure can itself be abused through social engineering.

6. Social Engineering

Sometimes the attacker does not attack the technology at all.

They attack the person.

An attacker may impersonate:

• IT support

• A bank employee

• A manager

• A colleague

• A service provider

The goal is to convince the victim to reveal a verification code, approve a login, reset authentication, or provide information that helps the attacker gain access.

Technology becomes much less effective when users are manipulated into bypassing their own security controls.

MFA Is Not the Problem

It is important not to misunderstand the situation.

The answer is not to disable MFA.

MFA remains a critical layer of protection.

The real lesson is that organizations should move from phishable MFA toward phishing-resistant authentication.

The NCSC now recommends passkeys wherever supported and states that correctly implemented FIDO2 credentials can provide stronger protection than traditional MFA against common credential attacks. (National Cyber Security Centre)

What Makes Passkeys Different?

Passkeys use public-key cryptography rather than requiring users to provide a reusable password or manually enter a shared authentication code.

The private cryptographic key remains protected by the user's device or credential manager, while the service receives the corresponding public key.

Because the authentication is cryptographically bound to the legitimate website or service, a fake phishing website cannot simply collect the passkey in the same way it can collect a password or one-time code.

The NCSC specifically notes that passkeys remove the ability to cheaply reuse or relay credentials in the way traditional authentication secrets can be attacked. (National Cyber Security Centre)

A Major Authentication Shift Is Already Underway

This isn't merely a theoretical future.

In April 2026, the NCSC announced its move toward recommending passkeys wherever supported. (National Cyber Security Centre)

Microsoft is also accelerating the transition.

According to Microsoft's current Entra documentation, passkeys become the default authentication experience on September 1, 2026 for users currently enabled for SMS or voice authentication. Microsoft-provided SMS and voice authentication are scheduled for retirement on February 1, 2027. (Microsoft Learn)

Microsoft says passkeys supported in Entra use cryptographic keys and are designed to resist phishing, SIM swapping, and replay attacks. (Microsoft Learn)

This represents a major shift from:

Password → SMS code → authentication

toward:

Device/credential → cryptographic proof → authentication

How Individuals Can Strengthen Their Authentication

✅ Enable MFA

If an account supports MFA, use it.

MFA is still significantly better than relying on a password alone.

✅ Prefer Passkeys Where Available

If a trusted service supports passkeys, consider using them instead of relying exclusively on passwords and traditional MFA.

The NCSC now recommends this approach where passkeys are supported. (National Cyber Security Centre)

✅ Never Approve Unexpected MFA Requests

If you didn't initiate the login, don't approve it.

✅ Be Suspicious of Urgent Authentication Requests

Attackers often create urgency:

• "Approve this now."

• "Your account will be locked."

• "IT needs you to verify."

• "Your payment failed."

Stop and verify independently.

✅ Secure Your Devices

Passkeys and authentication applications ultimately depend on the security of the devices and credential managers protecting them. The NCSC emphasizes that users still need secure devices and appropriate recovery options. (National Cyber Security Centre)

How Organizations Can Strengthen Authentication

Organizations should consider a layered approach.

1. Move Toward Phishing-Resistant Authentication

Prioritize:

• Passkeys

• FIDO2 security keys

• Windows Hello for Business

• Other phishing-resistant authentication mechanisms

2. Reduce Dependence on SMS

SMS remains useful in some situations, but organizations handling sensitive systems should evaluate stronger alternatives.

Microsoft is already moving its Entra ecosystem away from native SMS and voice authentication toward passkeys and other phishing-resistant methods. (Microsoft Learn)

3. Monitor Authentication Behavior

Security teams should investigate:

• Impossible travel

• Unusual login locations

• Repeated MFA requests

• New devices

• Suspicious session activity

• Abnormal authentication patterns

4. Protect Sessions

Strong authentication should be complemented with controls that protect session tokens, devices, browsers, and endpoints.

This is particularly important because stolen authenticated sessions can sometimes bypass the need to repeat MFA. (Huntress)

5. Educate Employees

Employees should understand that:

"I have MFA enabled" does not mean "I cannot be hacked."

Security awareness should teach users how MFA attacks actually work.

The Future of Authentication

The future is moving toward authentication that is:

• Passwordless

• Phishing-resistant

• Cryptographically based

• Device-aware

• Risk-aware

• Continuously monitored

Passkeys are becoming a major part of this transition.

As adoption increases, organizations will increasingly combine strong authentication with device security, identity monitoring, behavioral analytics, and Zero Trust principles.

The Bigger Lesson

MFA taught the cybersecurity world an important lesson:

Adding another security layer is valuable but attackers will eventually adapt to that layer too.

The next generation of cybersecurity therefore isn't simply about adding more authentication steps.

It is about making authentication harder to steal, relay, replay, or manipulate.

That is why phishing-resistant authentication matters.

Conclusion

Multi-Factor Authentication remains one of the most important defenses against account compromise, but not every MFA method offers the same level of protection.

Cybercriminals have evolved from stealing passwords to attacking authentication workflows, manipulating users, stealing sessions, and intercepting authentication processes.

The cybersecurity community is responding by moving toward stronger forms of authentication such as passkeys and FIDO2 credentials.

The transition is already happening. The NCSC is recommending passkeys wherever supported, while Microsoft is making passkeys the default authentication experience in Entra ID beginning September 2026. (National Cyber Security Centre)

At OSMALLAMINTECH, we believe the goal isn't simply to have more security it is to have smarter security.

MFA was a major step forward.

Phishing-resistant authentication is the next step.

Author: OSMALLAMINTECH

Cybersecurity Awareness | Identity Security | Digital Resilience