How MFA gets hacked — and strategies to prevent it

The security benefits of multifactor authentication (MFA) are well-known, yet MFA continues to be poorly, sporadically, and inconsistently implemented, undercutting its effectiveness as a security tool while often saddling users with an extra workflow burden — one of many obstacles to MFA’s success.

Frequent news stories that describe innovative ways to circumvent MFA don’t help, such as evidence of an AI-fueled phishing attack that found cloud keys and SSH access details, and another case of an AI-based attack that leveraged Claude Code. Even the savviest vendors aren’t immune, as evidenced by a series of Okta attacks in 2023 that resulted in stolen GitHub source code, an infected supply chain, and a compromised support portal.

Still, MFA methods have gotten easier to use, thanks to the growing popularity and sophistication of passwordless approaches. Over the past several years, MFA mandates from big vendors such as Google and Microsoft for both employees and customers have helped motivate IT operations to strengthen their authentication practices and encourage comprehensive and continuous authentication across all applications. 

According to a JumpCloud 2025 survey, 87% of larger enterprises regularly employ MFA methods, although only about a third of smaller firms did the same. Cisco more recently found that while 87% of survey respondents agreed that having phishing-resistant MFA methods were critical, less than 20% had implemented any such procedure across their enterprises.

We used the following references that describe many of the MFA exploits in further technical detail, and how to prevent them, including:

• A collection of bypass methods illustrated by Abnormal Security
• KnowBe4’s extensive slide deck detailing a number of MFA exploit methods, though somewhat outdated
• The FIDO Alliance’s series of white papers on how enterprises can implement better MFA methods
• JumpCloud’s collection of MFA usage statistics from surveys
• Cisco Duo’s MFA Buyer’s Guide, which details how to cost-justify stronger MFA deployments
• RSA’s useful deep dive on implementing better MFA programs via its passwordless solutions

Notable MFA threat modalities and common attack techniques

The below table offers an overview of four common MFA threat modalities, along with the associated attack methods applied across specific locations.

Of note is that fact that attackers have found weaknesses across all aspects of enterprise computing infrastructure. Part of the problem is that the average modern authentication workflow is complex: Users can arrive at an application via a web portal, a smartphone app, an AI query, or an API. They can connect via a variety of endpoints, through a local network or a VPN, running different OSes and browsers. As a result, any enterprise testing its MFA portfolio must apply careful and continual vigilance to a grab bag of circumstances and locations where MFA codes can be intercepted.

MFA bypass and exploit technologies

MFA fatigue

MFA fatigue is an attack modality that involves rapidly sending numerous authorization requests, typically via SMS push messages, until a user gives in and approves the request, granting access to an attacker, such as what happened to Uber in 2022.

This is one of numerous reasons why SMS has long been considered a very insecure second factor channel and why it still is a threat, as evidenced by PayPal’s 2026 elimination of MFA-based SMS.

These attacks also go by the name “push bombing” or “prompt bombing” and are not limited to mobile exploits. MFA fatigue can also take advantage of gaps in authentication or access control policies. The irony is that the more MFA an organization uses, the more likely an MFA fatigue attack will succeed.

Social engineering

Attackers also use a combination of social engineering andphishing attacks — based on SMS (smishing) or voice calls (vishing) to disrupt the overall authentication workflow and trick users into giving up MFA tokens.

Changes in user behavior, such as more remote post-pandemic usage and events such as the World Cup, are often exploited by bad actors. Arctic Wolf wrote in its blog, “Using social engineering along with an MFA fatigue attack can be effective for threat actors, as it creates a false sense of trust.”

These combination attacks also often lure users to fake websites, real-time phishing relays, or proxy servers to capture one-time passcodes. For mobile authenticators, SIM swaps can also be used to redirect one-time codes to an attacker’s phone. These happen by convincing a customer service employee at a telecommunications provider that they are the legitimate phone owner and then use SMS to access authentication messages.

More recently we’ve seen exploits that use account recovery or password reset fallbacks to circumvent MFA protections.

Stealing authentication cookies

Hijackers can also compromise MFA sessions by stealing authentication cookies or other tokens. This can be accomplished in several ways, including setting up phony login pages, using relays or man-in-the-middle or man-in-the-browser proxies to intercept and obtain the MFA codes.

A Joomla compromise from last year provides an example. Because numerous websites don’t enforce session inactivity time limits, attackers could use endpoints that had received prior authentication and steal cookies to bypass MFA. “The authorization process does not have a way of knowing whether the current holder of that access control token was the legitimate user or ever successfully authenticated. This key fact is often used by hackers to compromise MFA,” KnowBe4’s researchers wrote in their report.

Targeting weak authentication

Targeting non-MFA users and applications with weak passwords is another common threat modality that can operate across the entire computing spectrum. While MFA adoption has improved, it still is far from universal, and attackers count on finding those unprotected places and users to target their efforts accordingly.

A few years ago Akira ransomware threat actors infiltrated organizations using Cisco VPNs that were not configured for MFA, where they could use brute force to obtain user credentials. Going back to the 2021 Colonial Pipeline attack, analysts found it was caused by compromising a single password used on a legacy VPN that wasn’t running any MFA.

Using other service accounts that may have been once used by administrators or by users who have either forgotten them or left the company are also a common pathway for these types of compromises. There are also cases of taking advantage of already-authenticated IP addresses or devices, or direct attacks on cellular networks, or setting up proxy servers to intercept MFA codes.

Strategies to stop MFA attacks

Given all these exploits, MFA needs attention to detail to ensure security. Here are a few tips for ensuring your MFA strategy will be successful.

1. Understand what you’re trying to protect

First, security teams must understand the resources they seek to protect from compromise. “For example, cyber threat actors often target email systems, file servers, and remote access systems to gain access to an organization’s data, along with trying to compromise identity servers like Active Directory, which would allow them to create new accounts or take control of user accounts,” according to this CISA fact sheet.

CISA recommends systems that support FIDO protocols for the first recipients of MFA protection. This includes using hardware keys, better biometric controls, and setting up passwordless access for the most sensitive applications.

CISA’s fact sheet came out more than three years ago, and I feel its recommendations don’t go far enough: Better MFA should be enterprise wide.

Kevin Surace, CEO of biometric authentication provider Token.com, tells CSO: “We moved to MFA, and [the attackers] moved with us.” This means that enterprise security managers must up their game as well.

“There are some MFA methods without biometrics so it’s not as secure, as it doesn’t guarantee the person, just possession,” Surace says. “While it technically works short term, it’s not the end game. We will all be given services like Zoom and banking that will require real live biometrics to verify identity.”

One example is when Microsoft introduced conditional access and risk-based authentication to combat advanced MFA bypass techniques such as token theft and session hijacking, reflecting its ongoing efforts to strengthen identity security.

2. Get adaptive with authentication

Next, all authentications should be real-time, continuous risk-based assessments, and they should dynamically step up security requirements automatically based on what users are doing at any given moment.

The old ways of using a single access control moment when a user logs in need to be replaced accordingly. There are a number of authentication products that couple MFA into their adaptive authentication processes, and combine with the above hardened methods, such as asking for a passwordless verification when you want to add a new payee on your bank account.

3. Button down access rights

A companion effort should be a careful assessment and frequent review of user and application access rights.

IT security staff should ensure employees only receive access to limited data needed to accomplish their job responsibilities. But this is not always simple to accomplish, as roles and responsibilities change. Still, over the years it is common to see numerous users who are overprovisioned access rights without any subsequent auditing or reduction in these rights.

4. Conduct MFA workflow analysis regularly

All these points should be part of an overall MFA workflow analysis, which really isn’t anything new. Gerhard Giese from Akamai points this out in a 2021 blog post, when he talks about how MFA doesn’t always prevent credential stuffing.

Giese says IT managers need to “re-examine your authentication workflows and login screens to make sure an attacker cannot uncover valid credentials by interrogating the web server’s response and implement a bot management solution to make sure you are not making things easier for the bad guys.”

5. Review your password reset workflow

One aspect that seems to get historically neglected is the password reset workflow process, which is why it is a common target of attackers.

“Surprisingly, there are many websites that don’t have a second layer of verification for their 2FA reset password process, or they offer MFA but do not enforce users to employ it,” says Mitnick Security in this blog post. Having better MFA, along with limits on unsuccessful login attempts and password reuse can also help.

6. Ensure the security of high-value targets

Finally, you should assess and locate users who might be high-value targets.

“Every organization has a small number of user accounts that have additional access or privileges, which are especially valuable to cyber threat actors,” CISA writes in its report. Examples include IT and system administrators, staff attorneys, and HR managers. Consider these groups for an initial rollout phase of your MFA project.

MFA technology should be a part of corporate security’s critical infrastructure. Recent attacks, as well as urging from experts across government and the private sector, should provide further impetus for intelligent implementations.