{"id":8919,"date":"2026-07-29T08:00:00","date_gmt":"2026-07-29T08:00:00","guid":{"rendered":"https:\/\/cybersecurityinfocus.com\/?p=8919"},"modified":"2026-07-29T08:00:00","modified_gmt":"2026-07-29T08:00:00","slug":"how-mfa-gets-hacked-and-strategies-to-prevent-it","status":"publish","type":"post","link":"https:\/\/cybersecurityinfocus.com\/?p=8919","title":{"rendered":"How MFA gets hacked \u2014 and strategies to prevent it"},"content":{"rendered":"
\n
\n
\n
\n
<\/div>\n

The security benefits of\u00a0multifactor authentication (MFA)<\/a>\u00a0are well-known, yet MFA continues to be poorly, sporadically, and inconsistently implemented, undercutting its effectiveness as a security tool while often saddling users with an extra workflow burden \u2014 one of many obstacles to MFA\u2019s success.<\/p>\n

Frequent news stories that describe innovative ways to circumvent MFA don\u2019t help, such as evidence of\u00a0an AI-fueled phishing attack<\/a> that found cloud keys and SSH access details, and another case of an AI-based attack that leveraged Claude Code<\/a>. Even the savviest vendors aren\u2019t immune, as evidenced by a series of Okta attacks in 2023<\/a> that resulted in stolen GitHub source code, an infected supply chain, and a compromised support portal.<\/p>\n

Still, MFA methods<\/a>\u00a0have gotten easier to use, thanks to the growing popularity and\u00a0sophistication of passwordless approaches<\/a>. Over the past several years, MFA mandates from big vendors such as Google and Microsoft for both employees and customers have helped motivate IT operations to strengthen their authentication practices and encourage comprehensive and continuous authentication across all applications.\u00a0<\/p>\n

According to a JumpCloud 2025 survey<\/a>, 87% of larger enterprises regularly employ MFA methods, although only about a third of smaller firms did the same. Cisco more recently found<\/a> that while 87% of survey respondents agreed that having phishing-resistant MFA methods were critical, less than 20% had implemented any such procedure across their enterprises.<\/p>\n

We used the following references that describe many of the MFA exploits in further technical detail, and how to prevent them, including:<\/p>\n

A collection of bypass methods illustrated by Abnormal Security<\/a><\/p>\n

KnowBe4\u2019s extensive slide deck<\/a>\u00a0detailing a number of MFA exploit methods, though somewhat outdated<\/p>\n

The\u00a0FIDO Alliance\u2019s series of white papers<\/a>\u00a0on how enterprises can implement better MFA methods<\/p>\n

JumpCloud\u2019s collection of MFA usage statistics<\/a> from surveys<\/p>\n

Cisco Duo\u2019s MFA Buyer\u2019s Guide<\/a>, which details how to cost-justify stronger MFA deployments<\/p>\n

RSA\u2019s useful deep dive<\/a> on implementing better MFA programs via its passwordless solutions<\/p>\n

Notable MFA threat modalities and common attack techniques<\/h2>\n

The below table offers an overview of four common MFA threat modalities, along with the associated attack methods applied across specific locations.<\/p>\n

Of note is that fact that attackers have found weaknesses across all aspects of enterprise computing infrastructure. Part of the problem is that the average modern authentication workflow is complex: Users can arrive at an application via a web portal, a smartphone app, an AI query, or an API. They can connect via a variety of endpoints, through a local network or a VPN, running different OSes and browsers. As a result, any enterprise testing its MFA portfolio must apply careful and continual vigilance to a grab bag of circumstances and locations where MFA codes can be intercepted.<\/p>\n

MFA bypass and exploit technologies<\/strong><\/p>\n

Methods\u00a0NetworkMobileApplicationsWorkflowBrowser and cookieFatigueGaps in auth and access policies\u00a0Prompt bombing, Gaps in auth and access policies\u00a0Prompt bombingPrompt bombing, Gaps in auth and access policies\u00a0Prompt bombing, Gaps in auth and access policiesSocial EngineeringEvil proxy servers, Real-time phishing relayVishing, SMS phishing, SIM swappingNon MFA-enabled apps, Faked websites, TOTP relayConsent phishing, Account recovery abusesMan-in-the-browser, Consent phishingStealing auth tokens\/cookiesMITM attacksAuth app phisingMalicious MFA softwareSession hijackingSession hijacking, Pass-the-cookieTargeting weak authenticationManipulate trusted IPs\/devicesReused passwords, Lack of FIDO\/biometricsWeak account recovery, Non-MFA accounts, IMAP\/POP email accessPrior auth\/logins, Brute force MFASession hijacking, Pass-the-cookie, Man-in-the-browser, Consent phishing <\/div>\n

MFA fatigue<\/h3>\n

MFA fatigue is an attack modality that involves rapidly sending numerous authorization requests, typically via SMS push messages, until a user gives in and approves the request, granting access to an attacker, such as what happened to\u00a0Uber in 2022<\/a>.<\/p>\n

This is one of numerous reasons why SMS has long been considered a very insecure second factor channel<\/a> and why it still is a threat, as evidenced by PayPal\u2019s 2026 elimination of MFA-based SMS<\/a>.<\/p>\n

These attacks also go by the name \u201cpush bombing\u201d or \u201cprompt bombing\u201d and are not limited to mobile exploits. MFA fatigue can also take advantage of gaps in authentication or access control policies. The irony is that the more MFA an organization uses, the more likely an MFA fatigue attack will succeed.<\/p>\n

Social engineering<\/h3>\n

Attackers also use a combination of\u00a0social engineering andphishing attacks<\/a>\u00a0\u2014 based on SMS (smishing<\/a>) or voice calls (vishing<\/a>) to disrupt the overall authentication workflow and trick users into giving up MFA tokens.<\/p>\n

Changes in user behavior, such as more remote post-pandemic usage and events such as the World Cup, are often exploited by bad actors. Arctic Wolf\u00a0wrote in its blog<\/a>, \u201cUsing social engineering along with an MFA fatigue attack can be effective for threat actors, as it creates a false sense of trust.\u201d<\/p>\n

These combination attacks also often lure users to fake websites, real-time phishing relays, or proxy servers to capture one-time passcodes. For mobile authenticators, SIM swaps can also be used to redirect one-time codes to an attacker\u2019s phone. These happen by convincing a customer service employee at a telecommunications provider that they are the legitimate phone owner and then use SMS to access authentication messages.<\/p>\n

More recently we\u2019ve seen exploits that use account recovery or password reset fallbacks<\/a> to circumvent MFA protections.<\/p>\n

Stealing authentication cookies<\/h3>\n

Hijackers can also compromise MFA sessions by stealing authentication cookies or other tokens. This can be accomplished in several ways, including setting up phony login pages, using relays or man-in-the-middle or man-in-the-browser<\/a> proxies to intercept and obtain the MFA codes.<\/p>\n

A Joomla compromise from last year<\/a> provides an example. Because numerous websites don\u2019t enforce session inactivity time limits, attackers could use endpoints that had received prior authentication and steal cookies to bypass MFA. \u201cThe authorization process does not have a way of knowing whether the current holder of that access control token was the legitimate user or ever successfully authenticated. This key fact is often used by hackers to compromise MFA,\u201d KnowBe4\u2019s researchers wrote in their report.<\/p>\n

Targeting weak authentication<\/h2>\n

Targeting non-MFA users and applications with weak passwords\u00a0is another common threat modality that can operate across the entire computing spectrum. While MFA adoption has improved, it still is far from universal, and attackers count on finding those unprotected places and users to target their efforts accordingly.<\/p>\n

A few years ago Akira ransomware threat actors\u00a0infiltrated organizations using Cisco VPNs<\/a>\u00a0that were not configured for MFA, where they could use brute force to obtain user credentials. Going back to the 2021 Colonial Pipeline attack, analysts found it was caused by compromising\u00a0a single password used on a legacy VPN that wasn\u2019t running any MFA<\/a>.<\/p>\n

Using other service accounts that may have been once used by administrators or by users who have either forgotten them or left the company are also a common pathway for these types of compromises. There are also cases of taking advantage of already-authenticated IP addresses or devices, or direct attacks on cellular networks, or setting up proxy servers to intercept MFA codes.<\/p>\n

Strategies to stop MFA attacks<\/h2>\n

Given all these exploits, MFA needs attention to detail to ensure security. Here are a few tips for ensuring your MFA strategy will be successful.<\/p>\n

1. Understand what you\u2019re trying to protect<\/h3>\n

First, security teams must understand the resources they seek to protect from compromise. \u201cFor example, cyber threat actors often target email systems, file servers, and remote access systems to gain access to an organization\u2019s data, along with trying to compromise identity servers like Active Directory, which would allow them to create new accounts or take control of user accounts,\u201d\u00a0according to this CISA fact sheet<\/a>.<\/p>\n

CISA recommends systems that support\u00a0FIDO<\/a>\u00a0protocols for the first recipients of MFA protection. This includes using hardware keys, better biometric controls, and setting up passwordless access for the most sensitive applications.<\/p>\n

CISA\u2019s fact sheet came out more than three years ago, and I feel its recommendations don\u2019t go far enough: Better MFA should be enterprise wide.<\/p>\n

Kevin Surace, CEO of biometric authentication provider Token.com, tells CSO: \u201c<\/em>We moved to MFA, and [the attackers] moved with us.\u201d This means that enterprise security managers must up their game as well.<\/p>\n

\u201cThere are some MFA methods without biometrics so it\u2019s not as secure, as it doesn\u2019t guarantee the person, just possession,\u201d Surace says. \u201cWhile it technically works short term, it\u2019s not the end game. We will all be given services like Zoom and banking that will require real live biometrics to verify identity.\u201d<\/p>\n

One example is when Microsoft introduced conditional access and risk-based authentication<\/a>\u00a0to combat advanced MFA bypass techniques such as token theft and session hijacking, reflecting its ongoing efforts to strengthen identity security.<\/p>\n

2. Get adaptive with authentication<\/h3>\n

Next, all authentications should be real-time, continuous risk-based assessments, and they should dynamically step up security requirements automatically based on what users are doing at any given moment.<\/p>\n

The old ways of using a single access control moment when a user logs in need to be replaced accordingly. There are a\u00a0number of authentication products that couple MFA into their adaptive authentication processes<\/a>, and combine with the above hardened methods, such as asking for a passwordless verification when you want to add a new payee on your bank account.<\/p>\n

3. Button down access rights<\/h3>\n

A companion effort should be a careful assessment and frequent review of user and application access rights.<\/p>\n

IT security staff should ensure employees only receive access to limited data needed to accomplish their job responsibilities. But this is not always simple to accomplish, as roles and responsibilities change. Still, over the years it is common to see numerous users who are overprovisioned access rights without any subsequent auditing or reduction in these rights.<\/p>\n

4. Conduct MFA workflow analysis regularly<\/h3>\n

All these points should be part of an overall MFA workflow analysis, which really isn\u2019t anything new.\u00a0Gerhard Giese from Akamai points this out in a 2021 blog post<\/a>, when he talks about how MFA doesn\u2019t always prevent\u00a0credential stuffing<\/a>.<\/p>\n

Giese says IT managers need to \u201cre-examine your authentication workflows and login screens to make sure an attacker cannot uncover valid credentials by interrogating the web server\u2019s response and implement a bot management solution to make sure you are not making things easier for the bad guys.\u201d<\/p>\n

5. Review your password reset workflow<\/h3>\n

One aspect that seems to get historically neglected is the password reset workflow process, which is why it is a common target of attackers.<\/p>\n

\u201cSurprisingly, there are many websites that don\u2019t have a second layer of verification for their 2FA reset password process, or they offer MFA but do not enforce users to employ it,\u201d says\u00a0Mitnick Security in this blog post<\/a>. Having better MFA, along with limits on unsuccessful login attempts and password reuse can also help.<\/p>\n

6. Ensure the security of high-value targets<\/h3>\n

Finally, you should assess and locate users who might be high-value targets.<\/p>\n

\u201cEvery organization has a small number of user accounts that have additional access or privileges, which are especially valuable to cyber threat actors,\u201d CISA writes in its report. Examples include IT and system administrators, staff attorneys, and HR managers. Consider these groups for an initial rollout phase of your MFA project.<\/p>\n

MFA technology should be a part of corporate security\u2019s critical infrastructure. Recent attacks, as well as urging from experts across government and the private sector, should provide further impetus for intelligent implementations.<\/p>\n<\/div>\n<\/div>\n<\/div>\n<\/div>","protected":false},"excerpt":{"rendered":"

The security benefits of\u00a0multifactor authentication (MFA)\u00a0are well-known, yet MFA continues to be poorly, sporadically, and inconsistently implemented, undercutting its effectiveness as a security tool while often saddling users with an extra workflow burden \u2014 one of many obstacles to MFA\u2019s success. Frequent news stories that describe innovative ways to circumvent MFA don\u2019t help, such as […]<\/p>\n","protected":false},"author":0,"featured_media":8920,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[],"class_list":["post-8919","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-education"],"_links":{"self":[{"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/posts\/8919"}],"collection":[{"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"replies":[{"embeddable":true,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=8919"}],"version-history":[{"count":0,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/posts\/8919\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/media\/8920"}],"wp:attachment":[{"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=8919"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=8919"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=8919"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}