How MFA gets hacked — and strategies to prevent it

Multifactor authentication (MFA) remains vulnerable to bypass attacks including fatigue, social engineering, token theft, and weak authentication, according to a CSOonline analysis of recent exploits such as AI-fueled phishing and Okta breaches. A JumpCloud 2025 survey found 87% of large enterprises regularly use MFA, but only a third of smaller firms do, while Cisco reported that less than 20% of organizations have implemented phishing-resistant MFA despite 87% deeming it critical.

The security benefits of multifactor authentication MFA https://www.csoonline.com/article/563753/two-factor-authentication-2fa-explained.html are well-known, yet MFA continues to be poorly, sporadically, and inconsistently implemented, undercutting its effectiveness as a security tool while often saddling users with an extra workflow burden — one of many obstacles to MFA’s success. Frequent news stories that describe innovative ways to circumvent MFA don’t help, such as evidence of an AI-fueled phishing attack https://www.csoonline.com/article/4183445/autonomous-ai-agents-duped-into-leaking-sensitive-data-in-phishing-test.html that found cloud keys and SSH access details, and another case of an AI-based attack that leveraged Claude Code https://www.csoonline.com/article/4181230/claude-code-has-an-mcp-security-problem-and-your-developers-are-already-using-it.html . Even the savviest vendors aren’t immune, as evidenced by a series of Okta attacks in 2023 https://www.csoonline.com/article/656728/okta-support-system-breach-highlights-need-for-strong-mfa-policies.html that resulted in stolen GitHub source code, an infected supply chain, and a compromised support portal. Still, MFA methods https://www.csoonline.com/article/1305849/mfa-adoption-peaks-despite-lower-remote-access-authentications.html have gotten easier to use, thanks to the growing popularity and sophistication of passwordless approaches https://www.csoonline.com/article/649083/10-passwordless-authentication-solutions.html . Over the past several years, MFA mandates from big vendors such as Google and Microsoft for both employees and customers have helped motivate IT operations to strengthen their authentication practices and encourage comprehensive and continuous authentication across all applications. According to a JumpCloud 2025 survey https://jumpcloud.com/blog/multi-factor-authentication-statistics , 87% of larger enterprises regularly employ MFA methods, although only about a third of smaller firms did the same. Cisco more recently found https://duo.com/resources/ebooks/beyond-mfa that while 87% of survey respondents agreed that having phishing-resistant MFA methods were critical, less than 20% had implemented any such procedure across their enterprises. We used the following references that describe many of the MFA exploits in further technical detail, and how to prevent them, including: The below table offers an overview of four common MFA threat modalities, along with the associated attack methods applied across specific locations. Of note is that fact that attackers have found weaknesses across all aspects of enterprise computing infrastructure. Part of the problem is that the average modern authentication workflow is complex: Users can arrive at an application via a web portal, a smartphone app, an AI query, or an API. They can connect via a variety of endpoints, through a local network or a VPN, running different OSes and browsers. As a result, any enterprise testing its MFA portfolio must apply careful and continual vigilance to a grab bag of circumstances and locations where MFA codes can be intercepted. MFA bypass and exploit technologies | Methods | Network | Mobile | Applications | Workflow | Browser and cookie | | Fatigue | Gaps in auth and access policies | Prompt bombing, Gaps in auth and access policies | Prompt bombing | Prompt bombing, Gaps in auth and access policies | Prompt bombing, Gaps in auth and access policies | | Social Engineering | Evil proxy servers, Real-time phishing relay | Vishing, SMS phishing, SIM swapping | Non MFA-enabled apps, Faked websites, TOTP relay | Consent phishing, Account recovery abuses | Man-in-the-browser, Consent phishing | | Stealing auth tokens/cookies | MITM attacks | Auth app phising | Malicious MFA software | Session hijacking | Session hijacking, Pass-the-cookie | | Targeting weak authentication | Manipulate trusted IPs/devices | Reused passwords, Lack of FIDO/biometrics | Weak account recovery, Non-MFA accounts, IMAP/POP email access | Prior auth/logins, Brute force MFA | Session hijacking, Pass-the-cookie, Man-in-the-browser, Consent phishing | MFA fatigue is an attack modality that involves rapidly sending numerous authorization requests, typically via SMS push messages, until a user gives in and approves the request, granting access to an attacker, such as what happened to Uber in 2022 https://www.uber.com/newsroom/security-update/ . This is one of numerous reasons why SMS has long been considered a very insecure second factor channel https://www.csoonline.com/article/566075/why-sms-banking-is-still-a-bad-idea.html and why it still is a threat, as evidenced by PayPal’s 2026 elimination of MFA-based SMS https://www.csoonline.com/article/4134258/paypal-launches-latest-struggle-to-get-rid-of-sms-for-mfa.html . These attacks also go by the name “push bombing” or “prompt bombing” and are not limited to mobile exploits. MFA fatigue can also take advantage of gaps in authentication or access control policies. The irony is that the more MFA an organization uses, the more likely an MFA fatigue attack will succeed. Attackers also use a combination of social engineering and phishing attacks https://www.csoonline.com/article/573159/office-365-phishing-campaign-that-can-bypass-mfa-targets-10-000-organizations.html — based on SMS smishing https://www.csoonline.com/article/567547/smishing-and-vishing-how-these-cyber-attacks-work-and-how-to-prevent-them.html or voice calls vishing https://www.csoonline.com/article/569381/vishing-explained-how-voice-phishing-attacks-scam-victims.html to disrupt the overall authentication workflow and trick users into giving up MFA tokens. Changes in user behavior, such as more remote post-pandemic usage and events such as the World Cup, are often exploited by bad actors. Arctic Wolf wrote in its blog https://arcticwolf.com/resources/blog/growing-risk-of-mfa-fatigue-attacks/ , “Using social engineering along with an MFA fatigue attack can be effective for threat actors, as it creates a false sense of trust.” These combination attacks also often lure users to fake websites, real-time phishing relays, or proxy servers to capture one-time passcodes. For mobile authenticators, SIM swaps can also be used to redirect one-time codes to an attacker’s phone. These happen by convincing a customer service employee at a telecommunications provider that they are the legitimate phone owner and then use SMS to access authentication messages. More recently we’ve seen exploits that use account recovery or password reset fallbacks https://workos.com/blog/passkeys-stop-ai-phishing-mfa-fallbacks to circumvent MFA protections. Hijackers can also compromise MFA sessions by stealing authentication cookies or other tokens. This can be accomplished in several ways, including setting up phony login pages, using relays or man-in-the-middle or man-in-the-browser https://zitadel.com/blog/2fa-bypass-attacks proxies to intercept and obtain the MFA codes. A Joomla compromise from last year https://www.sentinelone.com/vulnerability-database/cve-2025-25227/ provides an example. Because numerous websites don’t enforce session inactivity time limits, attackers could use endpoints that had received prior authentication and steal cookies to bypass MFA. “The authorization process does not have a way of knowing whether the current holder of that access control token was the legitimate user or ever successfully authenticated. This key fact is often used by hackers to compromise MFA,” KnowBe4’s researchers wrote in their report. Targeting non-MFA users and applications with weak passwords is another common threat modality that can operate across the entire computing spectrum. While MFA adoption has improved, it still is far from universal, and attackers count on finding those unprotected places and users to target their efforts accordingly. A few years ago Akira ransomware threat actors infiltrated organizations using Cisco VPNs https://blogs.cisco.com/security/akira-ransomware-targeting-vpns-without-multi-factor-authentication that were not configured for MFA, where they could use brute force to obtain user credentials. Going back to the 2021 Colonial Pipeline attack, analysts found it was caused by compromising a single password used on a legacy VPN that wasn’t running any MFA https://www.reuters.com/business/colonial-pipeline-ceo-tells-senate-cyber-defenses-were-compromised-ahead-hack-2021-06-08/ . Using other service accounts that may have been once used by administrators or by users who have either forgotten them or left the company are also a common pathway for these types of compromises. There are also cases of taking advantage of already-authenticated IP addresses or devices, or direct attacks on cellular networks, or setting up proxy servers to intercept MFA codes. Given all these exploits, MFA needs attention to detail to ensure security. Here are a few tips for ensuring your MFA strategy will be successful. First, security teams must understand the resources they seek to protect from compromise. “For example, cyber threat actors often target email systems, file servers, and remote access systems to gain access to an organization’s data, along with trying to compromise identity servers like Active Directory, which would allow them to create new accounts or take control of user accounts,” according to this CISA fact sheet https://www.cisa.gov/sites/default/files/publications/fact-sheet-implementing-phishing-resistant-mfa-508c.pdf . CISA recommends systems that support FIDO https://www.csoonline.com/article/574265/why-it-might-be-time-to-consider-using-fido-based-authentication-devices.html protocols for the first recipients of MFA protection. This includes using hardware keys, better biometric controls, and setting up passwordless access for the most sensitive applications. CISA’s fact sheet came out more than three years ago, and I feel its recommendations don’t go far enough: Better MFA should be enterprise wide. Kevin Surace, CEO of biometric authentication provider Token.com, tells CSO: “ We moved to MFA, and the attackers moved with us.” This means that enterprise security managers must up their game as well. “There are some MFA methods without biometrics so it’s not as secure, as it doesn’t guarantee the person, just possession,” Surace says. “While it technically works short term, it’s not the end game. We will all be given services like Zoom and banking that will require real live biometrics to verify identity.” One example is when Microsoft introduced conditional access and risk-based authentication https://entra.microsoft.com/blog/2025/02/security-updates-mfa-bypass/ to combat advanced MFA bypass techniques such as token theft and session hijacking, reflecting its ongoing efforts to strengthen identity security. Next, all authentications should be real-time, continuous risk-based assessments, and they should dynamically step up security requirements automatically based on what users are doing at any given moment. The old ways of using a single access control moment when a user logs in need to be replaced accordingly. There are a number of authentication products that couple MFA into their adaptive authentication processes https://www.csoonline.com/article/572123/12-risk-based-authentication-tools-compared.html , and combine with the above hardened methods, such as asking for a passwordless verification when you want to add a new payee on your bank account. A companion effort should be a careful assessment and frequent review of user and application access rights. IT security staff should ensure employees only receive access to limited data needed to accomplish their job responsibilities. But this is not always simple to accomplish, as roles and responsibilities change. Still, over the years it is common to see numerous users who are overprovisioned access rights without any subsequent auditing or reduction in these rights. All these points should be part of an overall MFA workflow analysis, which really isn’t anything new. Gerhard Giese from Akamai points this out in a 2021 blog post https://www.akamai.com/blog/trends/keeping-up-with-the-botnets , when he talks about how MFA doesn’t always prevent credential stuffing https://www.csoonline.com/article/567905/credential-stuffing-explained-how-to-prevent-detect-and-defend-against-it.html . Giese says IT managers need to “re-examine your authentication workflows and login screens to make sure an attacker cannot uncover valid credentials by interrogating the web server’s response and implement a bot management solution to make sure you are not making things easier for the bad guys.” One aspect that seems to get historically neglected is the password reset workflow process, which is why it is a common target of attackers. “Surprisingly, there are many websites that don’t have a second layer of verification for their 2FA reset password process, or they offer MFA but do not enforce users to employ it,” says Mitnick Security in this blog post https://www.mitnicksecurity.com/blog/bypass-2fa . Having better MFA, along with limits on unsuccessful login attempts and password reuse can also help. Finally, you should assess and locate users who might be high-value targets. “Every organization has a small number of user accounts that have additional access or privileges, which are especially valuable to cyber threat actors,” CISA writes in its report. Examples include IT and system administrators, staff attorneys, and HR managers. Consider these groups for an initial rollout phase of your MFA project. MFA technology should be a part of corporate security’s critical infrastructure. Recent attacks, as well as urging from experts across government and the private sector, should provide further impetus for intelligent implementations.