Can MFA Be Hacked? 8 Common MFA Bypass Techniques Explained

MFA can be hacked. Learn 8 MFA bypass techniques attackers use today, which methods are most vulnerable, and how to harden your deployment against them.

Can MFA Be Hacked?

Multi-factor authentication (MFA) is the control most teams trust to keep a stolen password from becoming a breach. And attackers have spent years learning to route around it. So, can MFA be hacked? Yes. MFA raises the cost of an attack, but it does not eliminate it. 

The problem is not with the concept of MFA. Most deployments rely on factors that attackers have learned to intercept, redirect, or socially engineer around. SMS codes can be rerouted. Push notifications can be spammed. Session tokens can be stolen after legitimate authentication completes. Help desk staff can be tricked into resetting MFA altogether. Verizon’s 2025 Data Breach Investigations Report (DBIR) found that suspicious login patterns are a recurring sign of credential theft and MFA bypass activity.

In December 2024, the FBI and the Cybersecurity and Infrastructure Security Agency (CISA) took the unusual step of advising organizations and users to move away from SMS-based MFA, citing active exploitation tied to the Salt Typhoon espionage campaign targeting US telecommunications infrastructure. The CISA mobile guidance recommends Fast Identity Online (FIDO)-based authentication as the strongest form of MFA effective against bypass techniques.

Understanding how each bypass technique works is the first step toward building defenses that hold.

8 Common MFA Bypass Techniques

Each technique below targets a different weakness in MFA deployments, from human error to protocol-level flaws. Some require social engineering. Others run with no human in the loop at all.

1. MFA Prompt Bombing (push fatigue)

The attacker obtains valid credentials through phishing or data breaches, then triggers repeated MFA push notifications until the user approves one out of frustration. Per CISA AA23-320A, Scattered Spider "continuously sends MFA notification prompts to lead employees to accept the prompt and gain access to the target network." APT29 has also used this technique.

What to look for in your SOC: Repeated MFA requests to a single account within a short period, login attempts from unusual locations, and sequences of failed authentication followed by a sudden approval.

2. Session Hijacking and Token Theft

This technique targets what happens after authentication. Attackers exploit vulnerabilities in remote access infrastructure, VPNs, web gateways, or application servers to extract valid session tokens. They replay those tokens to establish authenticated sessions without ever triggering an MFA challenge. LockBit affiliates demonstrated this through the CitrixBleed flaw (CVE-2023-4966), harvesting session tokens from Citrix NetScaler appliances to bypass MFA entirely.

To see how account hijacking and session token abuse connect, our guide covers the mechanics and detection controls that catch it.

What to look for in your SOC: Sessions originating from geographically impossible locations, multiple concurrent sessions for a single user, and authentication flows that skip expected MFA prompts.

3. SIM Swapping

The attacker gathers personally identifiable information (PII) through social engineering or open-source intelligence (OSINT), then contacts the mobile carrier to transfer the victim's phone number to an attacker-controlled SIM. All SMS-based MFA codes now route to the attacker. Per CISA AA23-320A, Scattered Spider systematically employs SIM swapping as part of data extortion operations.

What to look for in your SOC: Sudden loss of mobile service or unexpected SIM deactivation messages from the carrier, SMS MFA codes used from devices different than previously registered, and account access occurring immediately following SIM swap activity.

4. Adversary-in-the-Middle (AiTM) Phishing

The attacker positions a reverse-proxy server between you and a legitimate authentication portal. You enter your credentials and complete your MFA challenge. The proxy captures both. The attacker uses the stolen session token to walk right in. 

Phishing-as-a-Service platforms have helped commoditize this technique. Reverse-proxy phishing kits now specialize in AiTM attacks against common cloud identity workflows. Kits like Mamba 2FA target major cloud identity platforms and implement anti-bot identification to evade security scanning.

Our guide on adversary-in-the-middle attacks covers how AiTM differs from classic man-in-the-middle techniques and how to find indicators in your environment.

What to look for in your SOC: Authentication requests originating from virtual private server (VPS) or proxy infrastructure, suspicious domain registrations mimicking your login portals, and short gaps between credential entry and access from a different IP.

5. Social Engineering of Help Desks

Per CISA AA23-320A, Scattered Spider executes a multi-phase attack against IT support: first conducting reconnaissance calls to learn password reset procedures, then impersonating employees to convince help desk staff to reset MFA tokens. Since early 2023, this technique has granted access to "single sign-on (SSO) accounts and cloud-based application suites." Contracted or outsourced help desks are particularly vulnerable due to less stringent verification.

What to look for in your SOC: Unusual volumes of MFA reset requests for privileged accounts, especially outside business hours, and installation of remote access tools (TeamViewer, AnyDesk) following help desk interactions.

6. SS7 Protocol Exploitation

Signaling System 7, designed in the 1970s, remains the backbone of global mobile communications. Attackers who gain access to SS7 networks can redirect SMS traffic and intercept MFA codes in real time. SS7 abuse can intercept codes and enable fraud without deploying malware, making it a practical risk for any organization that relies on SMS-based MFA.

Following the Salt Typhoon campaign, SANS Institute guidance confirmed that CISA "bluntly stated: 'Do not use SMS as a second factor for authentication.'"

7. Real-Time Phishing Toolkits

Toolkits like EvilProxy, Evilginx, Sneaky2FA, and WikiKit operate as real-time credential and session replay platforms. They capture credentials and session tokens, then replay them before users or security teams find abnormalities. The rapid replay window creates a race that signature-based tools struggle to keep pace with.

Phishing has grown into a larger operational threat built around MFA abuse, modular tooling, and reusable infrastructure. Threat researchers continue to document how attackers package these workflows for reuse and distribution.

8. OAuth and Consent Phishing

The attacker registers a malicious application with an OAuth provider, then tricks a user into granting it permissions. The application receives legitimate OAuth tokens with user-granted access, bypassing MFA entirely. Refresh token mechanisms enable long-term persistence that often survives password resets.

From there, attackers manipulate service principals, create rogue OAuth applications, and exfiltrate sensitive data through cloud APIs and collaboration platforms. The Chinese state-sponsored group Silk Typhoon has used this technique to move across customer environments unnoticed.

What to look for in your SOC: New OAuth application registrations requesting high-privilege permissions, SAML tokens issued without MFA in identity logs, and unusual API call patterns to cloud APIs or collaboration platforms.

These eight techniques span social engineering, protocol exploitation, and post-authentication abuse. The MFA method you deploy determines how many of them your organization is exposed to.

Which MFA Methods Are Most Vulnerable to Bypass?

Not every MFA method is equally exposed to the eight techniques above. The table below maps five common MFA implementations against the bypass categories that can defeat them, based on CISA phishing-resistant guidance and FIDO Alliance classifications.

MFA Method	Vulnerable To	Phishing-Resistant?
SMS / Voice codes	SIM swapping, SS7 exploitation, AiTM phishing, real-time phishing toolkits	No
TOTP apps (Google Authenticator, Authy)	AiTM phishing, real-time phishing toolkits	No
Push notifications	Prompt bombing, AiTM phishing	No
Push with number matching	AiTM phishing (proxy relays the number in real time)	No
FIDO2 / WebAuthn security keys	None of the eight techniques above	Yes

The pattern is clear: every method built on shared secrets or user-approved prompts falls to at least one bypass technique. Only cryptographic authentication survives the full list.

Why Shared-Secret MFA Fails

The first four methods all lean on shared secrets or user-approved prompts, exactly what an an attacker can intercept or relay. FIDO2 keys work on a different principle entirely. The private key never leaves your device, and every authentication challenge is cryptographically bound to the real domain. A phishing proxy cannot forge a valid signature, because the domain never matches. Per NIST 800-63-4, only authenticators that use "asymmetric key cryptographic processes" qualify for the highest assurance level.

If you run SMS or push-based MFA today, you can cut your risk immediately. Move privileged accounts to FIDO2 keys first, then give standard users platform authenticators like Windows Hello and Apple Touch ID. It is a staged rollout, not a rip-and-replace, and the most practical path to phishing resistance without disrupting a single workday.

Real-World MFA Bypass Attack Examples

The techniques above are not theoretical. Real-world breaches show how attackers chain MFA bypass techniques into multi-stage attacks, often within hours of gaining initial access.

1. MGM Resorts (2023). Scattered Spider compromised MGM's environment by calling the help desk, impersonating an employee, and persuading staff to reset MFA credentials. The attack used LinkedIn to identify IT staff and gather the details needed to pass verification checks. Disruption extended across hotel operations, casino systems, and customer data, with reported damages exceeding $100 million according to MGM's SEC 8-K filing.
2. Uber (2022). An attacker purchased stolen credentials from a dark web marketplace, then launched a sustained MFA prompt bombing campaign against an Uber contractor. After the contractor approved a push notification to stop the alerts, the attacker moved laterally across Uber's internal systems, including Slack, AWS, and Google Workspace, within hours. Uber's official security update confirmed the contractor's credentials were likely purchased on the dark web following malware infection of their personal device.
3. Salt Typhoon (2024). The Chinese state-sponsored group exploited SS7 protocol weaknesses to intercept SMS-based MFA codes targeting US telecommunications infrastructure. The FBI and CISA issued joint guidance advising organizations to stop using SMS-based MFA in direct response to active exploitation tied to this campaign.
4. Storm-0558 (2023). Microsoft disclosed that the Chinese-affiliated threat actor Storm-0558 forged authentication tokens using an acquired Microsoft signing key to access cloud email accounts across multiple customer organizations. The attack bypassed standard MFA controls by operating at the token layer rather than the credential layer, making the initial MFA challenge irrelevant.

Each incident exploited a different technique from the list above. The consistent thread: attackers adapt their method to the weakest link in each organization's MFA deployment.

Indicators of MFA Bypass Attempts

MFA bypass leaves traces across identity logs, endpoint telemetry, and network activity. Catch those signals early and you can respond before an attacker settles in.

Authentication anomalies:

• Logins from impossible locations within minutes of a successful authentication in another region
• Multiple concurrent active sessions for a single user account
• Authentication flows that complete without a corresponding MFA challenge in identity logs
• MFA challenges approved outside business hours or from devices not in the registered device list

Identity and access patterns:

• Sudden spike in MFA reset requests for privileged accounts
• New OAuth application registrations requesting high-privilege permissions
• SAML tokens issued without MFA context in identity provider logs
• Help desk tickets requesting MFA bypass or credential resets followed immediately by account access from a new device

Network and endpoint signals:

• Session activity originating from VPS infrastructure, anonymizing proxies, or Tor exit nodes
• Short time gaps between credential submission and subsequent access from a different IP
• Lateral movement beginning within minutes of a successful authentication event
• New remote access tools installed shortly after help desk contact

These indicators rarely appear in isolation during a bypass attempt. Correlating authentication events with endpoint and network signals is what separates a genuine bypass detection from a false positive.

How to Prevent MFA Bypass Attacks

Knowing the techniques is half the equation. Here is the encouraging part: every gap you just read about is closeable, and the moves to close them are well understood.

• Deploy phishing-resistant MFA as your primary control. Per CISA guidance, only FIDO2/WebAuthn and PKI-based authentication qualify as phishing-resistant. SMS codes, time-based one-time password (TOTP) apps, email links, and push notifications, even with number matching, are explicitly excluded. CISA states that legacy MFA methods are subject to phishing, SIM-swap, SS7 issues, and prompt bombing. Start deployment with your highest-privilege accounts: domain admins, cloud administrators, and security teams.
• Enforce token binding and session lifecycle controls. NIST IR 8587 provides token lifecycle guidance: isolate identity provider signing keys, rotate keys based on risk level, and enforce session timeouts aligned with NIST assurance levels. For privileged access, cap sessions and inactivity windows in line with higher NIST assurance requirements.
• Implement conditional access policies. Require compliant device posture and phishing-resistant MFA for all cloud application access. Per Cloud Security Alliance (CSA) guidance, incorporate location, device compliance, role context, and MFA assurance level into every access decision.
• Block legacy authentication protocols. CISA Binding Operational Directive (BOD) 25-01 mandates blocking legacy protocols because they cannot support MFA. Any legacy authentication flow represents a persistent bypass path, even when modern flows enforce strong MFA.
• Harden help desk processes. Technical controls fail when a social engineer convinces your help desk to reset them. Require multi-channel identity verification for all MFA resets on privileged accounts. Implement out-of-band callback procedures. Train help desk staff to recognize the reconnaissance patterns Scattered Spider uses.

Even with strong hardening, MFA bypass attempts will still occur. The question becomes how fast you find and stop them when they do.

MFA Bypass in Cloud and Identity Environments

Cloud changes the shape of the problem. It introduces MFA bypass risks that on-premises configurations never had to face.

• Single sign-on (SSO) chaining. When a compromised SSO session grants access to dozens of downstream applications, a single successful MFA bypass scales immediately. An attacker who steals an Okta or Microsoft Entra session token can move across the entire connected application portfolio without triggering additional MFA challenges on any integrated platform.
• Conditional access gaps. Many organizations enforce phishing-resistant MFA for primary cloud applications but leave gaps in legacy application connectors, API endpoints, or service principal configurations. Attackers identify and exploit these gaps. CISA BOD 25-01 mandates blocking legacy authentication protocols specifically because they bypass conditional access policies.
• Service principal and OAuth abuse. Cloud identity environments rely on service accounts and OAuth tokens for automation and integrations. These machine identities typically operate without MFA controls. Attackers compromise service principals, grant them elevated permissions through OAuth consent phishing, and use those permissions to persist in the environment long after the initial access credentials are rotated.
• Federated identity and SAML manipulation. Federated authentication between identity providers and cloud platforms creates additional attack surfaces. An attacker who compromises a signing key, as Storm-0558 demonstrated in 2023, can forge SAML assertions and access cloud resources without any MFA interaction.

Securing cloud identity requires applying the same phishing-resistant MFA controls to service accounts and OAuth flows that you apply to human users. Machine identity is the fastest-growing attack surface in cloud environments, and is the one most often left outside your MFA perimeter.

How SentinelOne Helps Detect MFA Bypass Attacks

MFA bypass attacks live in the space between authentication and access. Identity provider monitoring alone leaves gaps that attackers exploit. SentinelOne's SingularityTM Platform closes those gaps by correlating authentication events with endpoint behavior, network activity, and user actions across your environment.

Singularity Identity extends protection to your identity infrastructure. It catches in-progress attacks against Active Directory and cloud identity providers liike Entra ID, Ping, Okta, Duo, and SecureAuth in real time, on-premises and in the cloud. Behavioral AI flags impossible travel patterns, credential misuse, and privilege escalation linked to token manipulation. When identity activity lines up with session abuse, the platform acts. It terminates malicious processes, ends compromised sessions, and isolates affected endpoints.

Singularity Identity also scans continuously for weak, exposed, and compromised credentials, offering autonomous responses to stop credential-based attacks before they reach your environment.

Book a demo with SentinelOne to see how you can find and stop MFA bypass attacks across your environment.

Key Takeaways

MFA remains essential, but it is not unbreakable. Eight distinct bypass techniques, from prompt bombing to OAuth consent phishing, exploit weaknesses in legacy MFA. The path forward is clear: upgrade to a strategy built for this threat. 

Phishing-resistant MFA (FIDO2/WebAuthn) paired with behavioral monitoring that catches post-authentication anomalies in real time can turn MFA from a liability back into a genuine advantage.

FAQs

What is Multi-Factor Authentication (MFA)?

Multi-factor authentication (MFA) is a security method that requires users to verify their identity with two or more distinct types of evidence before accessing a system or application. 

These factors fall into categories: something you know (passwords, PINs), something you have (security keys, phones), and something you are (fingerprints, facial recognition). NIST 800-63-4 specifies that factors must come from different categories to qualify as true MFA.

Why can MFA be bypassed?

MFA can be bypassed because most deployments rely on shared secrets or user-approved prompts, not cryptographic binding. SMS codes, TOTP apps, and push notifications all require transmitting or confirming a value that an attacker can intercept, relay, or socially engineer. 

The authentication event itself can also be bypassed by stealing session tokens after a legitimate login completes, making the MFA challenge irrelevant. Only FIDO2/WebAuthn eliminates this class of bypass by binding authentication cryptographically to the legitimate domain, making relay and interception technically impossible

What is the difference between phishing-resistant MFA and standard MFA?

Standard MFA (SMS codes, push notifications, TOTP apps) relies on shared secrets that attackers can intercept, redirect, or replay. Phishing-resistant MFA uses cryptographic binding between the authenticator and the legitimate domain. 

FIDO2/WebAuthn and PKI-based methods (PIV/CAC) verify the server identity before releasing credentials, making relay and AiTM attacks technically impossible. CISA, NIST, and the FIDO Alliance all classify only these two methods as phishing-resistant.

How do attackers bypass MFA even when number matching is enabled?

Number matching stops basic push fatigue by requiring users to enter a displayed number. However, it does not stop AiTM phishing, where the attacker's proxy relays the real authentication flow in real time. 

The attacker sees the same number prompt and can relay it to the victim. CISA describes number matching as a temporary measure while organizations transition to phishing-resistant MFA, not a permanent defense.

Which MFA bypass technique is most common today?

Token theft and session hijacking are presented in the Verizon 2025 DBIR as leading MFA bypass concerns. They target post-authentication sessions rather than the authentication event itself, making the initial MFA challenge irrelevant once a valid session token is captured. 

Stopping token theft requires behavioral monitoring of session activity, impossible travel patterns, and concurrent session anomalies.

Should enterprises stop using SMS-based MFA entirely?

Organizations should move away from SMS-based MFA. Following the Salt Typhoon campaign, FBI and CISA guidance warned against relying on SMS as a second factor. Multiple attack techniques, including SS7 exploitation, SIM swapping, and AiTM phishing, can defeat SMS-based MFA. 

Transition to FIDO2 security keys for privileged accounts and hardware-bound platform authenticators for standard users.

What MITRE ATT&CK techniques map to MFA bypass attacks?

The eight primary techniques map to several ATT&CK IDs: T1621 (MFA Request Generation) covers prompt bombing and real-time phishing flows. T1550 (Use Alternate Authentication Material) covers session hijacking. T1589 (Gather Victim Identity Information) supports SIM swapping. 

T1111 (MFA Interception) covers SS7 exploitation. T1566.004 (Spearphishing Voice) covers help desk social engineering. T1606 (Forge Web Credentials) covers OAuth consent phishing.