Attack Techniques
What Is MFA Bypass?
Multi-factor authentication (MFA) bypass refers to the exploitation of authentication security controls through techniques that circumvent, disable, or compromise MFA mechanisms without requiring the legitimate second factor.
Multi-factor authentication (MFA) bypass refers to the exploitation of authentication security controls through techniques that circumvent, disable, or compromise MFA mechanisms without requiring the legitimate second factor. MFA bypass attacks target fundamental weaknesses in how MFA is implemented, deployed, or interacted with by users, recognizing that while MFA protects the authentication moment, it does not necessarily protect the session that follows, according to Obsidian Security research published in 2025.
These attacks have evolved from theoretical vulnerabilities into practical, widespread techniques deployed daily by threat actors. Identity-based attacks rose 32% in the first half of 2025, with more than 97% originating from large-scale password attacks that attempt to leverage stolen credentials against MFA-protected accounts, according to the Morningstar/Ontinue 1H 2025 Threat Intelligence Report.
How does MFA bypass work?
MFA bypass techniques exploit various weaknesses across the authentication lifecycle, from the initial login moment through session management and account recovery processes.
Adversary-in-the-Middle (AiTM) phishing positions reverse proxy servers between users and legitimate login portals to intercept both credentials and one-time passwords during the authentication process. The attacker relays captured credentials and OTPs to the legitimate service while the code remains valid, effectively bypassing MFA. AiTM attacks surged 146% in the past year, with nearly 40,000 incidents detected daily, according to Obsidian Security's 2025 MFA Bypass report.
The technical mechanism involves attackers deploying reverse proxy infrastructure that presents users with visually authentic login pages. When users enter credentials and MFA codes, the proxy immediately relays these to the legitimate service, obtaining valid session tokens. Because the OTP is intercepted and used within its 30-120 second validity window, the authentication appears legitimate to both the user and the service.
Session hijacking and cookie theft operates on a different principle: once users authenticate, session tokens grant ongoing access without requiring re-authentication. Malware and browser extensions steal authenticated session cookies, allowing attackers to access protected applications and data without needing credentials or MFA codes. Session tokens are portable across devices and can be sold on dark web marketplaces, according to Obsidian Security.
MFA push notification bombing, also called fatigue attacks, floods users with repeated login prompts until exhaustion or confusion causes approval of a malicious request. 25% of recent attacks involve fraudulent MFA push notifications, according to the Morningstar/Ontinue Report. The Uber 2022 breach exemplified this technique, where continuous prompts over an hour eventually yielded unauthorized access.
SIM swapping exploits the reliance on phone numbers for SMS-based MFA. Attackers impersonate victims to mobile carriers and convince support staff to transfer phone numbers to attacker-controlled SIM cards, allowing interception of SMS-based MFA codes. In 2024, SIM swap attacks resulted in $26 million in losses reported to the FBI's IC3, according to DeepStrike research published in 2025. One March 2025 case resulted in a $33 million T-Mobile settlement.
Social engineering and help desk manipulation impersonate users or IT personnel to request MFA resets or credential resets from help desk staff, exploiting trust relationships and human psychology. The MGM breach exemplified this vector. In 2025, attackers employ AI voice cloning and deepfake technology to impersonate senior executives convincingly, according to NetRix Global's 2025 MFA bypass analysis.
Legacy protocol exploitation targets older protocols like IMAP, POP3, and SMTP that often lack MFA support, allowing direct bypass of modern authentication controls on email and legacy systems, according to Obsidian Security.
OAuth token theft and replay exploits stolen OAuth tokens from third-party integrations that grant access without triggering MFA, as tokens prove prior authorization. Roughly 20% of live MFA bypass incidents involved adversaries reusing stolen refresh tokens to bypass MFA, even after password resets, according to the Morningstar/Ontinue Report.
Authentication downgrade attacks force victims to fall back to phishable authentication methods such as push notifications or OTPs even when FIDO2 hardware keys are registered, according to IOActive's 2025 authentication downgrade research.
How does MFA bypass differ from other authentication attacks?
MFA bypass techniques differ fundamentally from traditional credential theft in their sophistication, targets, and required attacker capabilities.
Factor | AiTM Phishing | Push Bombing | SIM Swapping | Session Hijacking |
|---|---|---|---|---|
Requires stolen credentials | Yes | Yes | Yes (often) | No (targets post-auth) |
Real-time exploitation | Yes | Yes | No (async) | No (delayed) |
Targets user psychology | No | Yes | Yes (social eng) | No |
Detected as anomalous login | Often | No | Yes (different IP/device) | Sometimes |
Scope of compromise | Single session | Single session | Account + phone | All authenticated sessions |
Success rate / prevalence | 146% YoY growth | 25% of attacks | 327% surge (Kenya 2024-2025) | Growing rapidly |
Ideal for | Real-time MFA bypass at scale; evading TOTP and push-based MFA | Exploiting user fatigue when rate limiting is weak | Bypassing SMS-based MFA; high-value targeted attacks | Post-authentication access without triggering login alerts |
Traditional credential phishing requires only username and password theft, but fails when MFA is properly configured. MFA bypass techniques specifically target the second factor or the post-authentication session, making them effective even against accounts with active MFA protection.
AiTM phishing requires real-time interception infrastructure and operates within the brief validity window of one-time passwords. Push bombing exploits user fatigue rather than technical vulnerabilities. SIM swapping targets telecommunications infrastructure rather than the application itself. Session hijacking operates entirely post-authentication, making it fundamentally different from attacks targeting the login moment.
Why does MFA bypass matter?
The rise of MFA bypass techniques fundamentally challenges the assumption that multi-factor authentication provides comprehensive account security.
Approximately 70% of users in enterprise environments are using MFA as of early 2025; however, 28% of users who have enabled MFA are still targeted by attackers seeking to bypass it, according to Expert Insights' 2025 MFA statistics. This reveals a critical gap: organizations that deployed MFA believing it would eliminate account takeover risk face continued exposure.
The business impact proves substantial. Identity-based attacks rose 32% in the first half of 2025, demonstrating that attackers have successfully adapted to widespread MFA adoption by developing bypass techniques rather than abandoning credential-based attacks entirely.
The commoditization of MFA bypass tools makes these techniques accessible to lower-skilled attackers. OTP bot services cost $10-$50 per attack, with one Telegram-based platform user reporting $50,000 monthly earnings, according to Expert Insights research via Experian. The number of known phishing-as-a-service (PhaaS) kits doubled during 2025, with 90% of high-volume phishing campaigns relying on ready-made PhaaS toolchains. Eleven major AiTM phishing kits are now circulating commercially, according to Obsidian Security and NetRix Global research.
Organizations face regulatory and compliance implications. Many compliance frameworks mandate MFA as a security control, but the existence of practical bypass techniques means that MFA alone may not satisfy the underlying security objectives of these requirements. Organizations must implement defense-in-depth strategies rather than treating MFA as a complete solution.
The reputational damage from successful MFA bypass attacks can be severe. When organizations promote their use of MFA as a security differentiator, successful bypass attacks that lead to data breaches undermine customer trust and demonstrate security control failures.
What are the limitations of MFA bypass attacks?
Despite their effectiveness, MFA bypass techniques face significant operational and technical constraints that limit their universal applicability.
Hardware security keys (FIDO2) resistance represents the most significant limitation. FIDO2 hardware tokens resist MFA bypass techniques because they use public-key cryptography to verify the legitimate service, preventing AiTM phishing and token reuse attacks. However, adoption remains below 5% enterprise-wide, according to Obsidian Security research.
Google's security research published in 2025 confirms that properly implemented FIDO2 provides immunity to credential phishing, AiTM attacks, and token replay because the cryptographic challenge-response mechanism binds authentication to the specific service. Physical loss or theft of the hardware key or compromise of the user's primary device remains the primary vulnerability.
Anomalous session patterns enable detection when organizations monitor for access from unexpected geographies or IP ranges, access from VPN/Tor networks when users normally don't use them, or device fingerprint mismatches such as different OS, browser, or screen resolution.
SIM swap limitations have increased as carriers like T-Mobile and Verizon strengthened verification procedures post-2024 settlements, making SIM swaps harder but not impossible. Success still requires either social engineering or insider collusion, with 96% of SIM swap cases involving one of these factors, according to DeepStrike.
Push notification fatigue duration requirements expose attackers to detection risk. Push bombing requires repeated automated login attempts, which can be rate-limited by authentication servers or flagged as account compromise attempts. Organizations deploying strict rate limiting after 5-10 failed MFA attempts frustrate sustained bombing campaigns.
Phishing awareness among well-trained users and security-conscious organizations enables identification of AiTM phishing sites by checking SSL certificate details, domain names, and visual design inconsistencies. Organizations with strong MFA training and rate limiting observe sub-5% compromise rates from fatigue attacks, according to Ping Identity research.
How can organizations defend against MFA bypass?
Defense against MFA bypass requires implementing controls across authentication, session management, monitoring, and incident response.
Deploy hardware security keys (FIDO2/WebAuthn) as the primary defense. Implement FIDO2 hardware tokens or platform authenticators like Windows Hello or Face ID that bind authentication to the specific service and device, preventing token reuse and AiTM attacks. Google and Obsidian Security research published in 2025 confirms FIDO2 effectively eliminates most MFA bypass techniques.
Prioritize FIDO2 deployment for high-value accounts including administrators, financial personnel, executives, and any accounts with access to sensitive data or systems. Organizations should plan phased rollouts starting with highest-risk users.
Implement Device Bound Session Credentials (DBSC) to make stolen cookies harder to reuse from another device. DBSC binds session tokens to the specific device that created them, according to Google Threat Analysis Group research published in 2025. If session tokens are stolen, they cannot be used on different devices even if attackers spoof device fingerprints.
Enforce session timeout and re-authentication policies. Implement shorter session timeout windows and require re-authentication for sensitive actions. Application-level tokens should invalidate when IdP sessions end. Many organizations fail to synchronize application session timeouts with identity provider timeouts, allowing stolen tokens to remain valid even after official sessions expire, according to Obsidian Security.
Deploy behavioral analytics and anomaly detection to detect impossible travel (access from distant locations within short time windows), device fingerprint mismatches, access patterns diverging from baseline, and VPN/Tor usage by users who don't normally use it. Obsidian Security and Vectra AI research published in 2025 emphasizes correlation of identity, network, and behavioral data for effective detection.
Implement rate limiting and account lockout policies. Implement strict rate limiting on login attempts and MFA prompt generation to frustrate push bombing attacks. Lock accounts temporarily after N failed MFA attempts, typically after 5-10 failures. LoginRadius research published in 2025 recommends aggressive rate limiting: no more than 5 failed MFA attempts per 5-minute window.
Eliminate SMS-based MFA where possible. Migrate away from SMS and push notification-based MFA to app-based OTP (HOTP/TOTP) or hardware keys. The FBI and CISA recommended against SMS for authentication in 2025 guidance, citing lack of encryption and vulnerability to interception.
Strengthen help desk verification procedures to prevent social engineering. Implement strict identity verification for password reset and MFA reset requests requiring secondary proof of identity through security questions or ID verification. Disable direct MFA/password reset authority for front-line support. Use callback verification to original phone/email, according to Obsidian Security recommendations.
Monitor legacy protocols and disable or restrict IMAP, POP3, and SMTP access for accounts with sensitive data. Enforce modern authentication standards across all email and legacy system access, according to Obsidian Security.
Implement credential monitoring and breach notification systems. Continuously monitor for leaked credentials and notify users immediately if their credentials appear in breaches, allowing password rotation before exploitation, according to Expert Insights research.
FAQs
Can MFA bypass occur without stolen credentials?
No, most MFA bypass techniques including session hijacking, AiTM phishing, and push bombing require either valid credentials or a compromised session. The exception is SIM swapping, which can be attempted using only publicly available personal information via social engineering, according to Obsidian Security research published in 2025.
Session hijacking specifically targets post-authentication cookies and tokens, which requires the user to have successfully authenticated first. AiTM phishing intercepts credentials and MFA codes during a legitimate login attempt, requiring the attacker to have tricked the user into initiating authentication. Push bombing floods users with MFA prompts, but these prompts are only generated when the attacker attempts login with valid credentials.
Is FIDO2 completely immune to MFA bypass?
FIDO2 hardware keys are resistant to MFA bypass attacks because they verify the legitimacy of the service before authenticating, preventing AiTM, token reuse, and social engineering attacks, according to Google security research published in 2025. However, physical loss or theft of the hardware key or compromise of the user's primary device through malware remains a vulnerability.
The cryptographic nature of FIDO2 means that even if an attacker intercepts the authentication exchange, they cannot replay it or use it against a different service. The hardware key generates cryptographic signatures that are bound to both the specific service and the specific authentication request, making them unusable in other contexts.
Organizations should implement policies for lost or stolen hardware keys including immediate deregistration procedures, backup authentication methods for account recovery, and monitoring for suspicious authentication attempts using compromised keys.
How long does a stolen session cookie remain valid?
Validity depends on application configuration. Session cookies can range from 30 minutes to several hours or days. Some applications extend validity to weeks. Applications rarely sync cookie expiration with IdP session timeout, allowing attackers to maintain access even after an IdP session ends, according to Obsidian Security research.
Short-lived session tokens with 5-15 minute validity combined with automatic refresh token rotation limit the exploitable window for stolen tokens. However, most organizations still use 1-8 hour session windows, providing attackers substantial operational time.
Organizations should implement session invalidation on password changes, MFA modifications, or security alert triggers. All active sessions should be terminated when users change passwords or modify authentication settings, though many organizations fail to synchronize this across all applications.
What is the success rate of push bombing attacks?
In real-world incidents, attackers report success rates of 10-20% on initial push bombing attempts, with success increasing to 30-40% when combined with social engineering calls claiming to be IT support, according to Obsidian Security research. The Uber 2022 breach succeeded after continuous prompts over approximately one hour.
Success rates vary significantly based on user training and organizational security culture. Organizations with strong MFA awareness training and strict rate limiting observe sub-5% compromise rates from fatigue attacks, according to Ping Identity research published in 2025. Untrained users facing unexpected prompts during high-stress periods show vulnerability rates above 40%.
The timing of attacks matters substantially. Push bombing attempts during business hours when users are actively working and may have legitimately triggered authentication flows show higher success rates than attacks during off-hours when users are unlikely to be working.
Can organizations detect session hijacking in real-time?
Yes, organizations deploying behavioral analytics, device fingerprinting, and geolocation monitoring can detect session hijacking when sessions originate from unexpected geographies or IP ranges, device fingerprints including OS, browser, and screen resolution change unexpectedly, or access patterns deviate significantly from baseline behavior. Detection requires integrating logs from applications, IdP, and network security tools, according to Obsidian Security and Vectra AI research published in 2025.
Effective detection requires establishing baseline behaviors for each user including typical access times, common geographic locations, standard device types, and normal data access patterns. Deviations from these baselines trigger alerts for security team investigation.
Real-time detection enables rapid response including forced session termination, account lockdown pending verification, user notification of suspicious activity, and investigation of potential credential compromise. Organizations should define clear response procedures for different alert types and severity levels.
