
MFA Bypass Is the New Phishing: How Attackers Are Getting Past Multi-Factor Authentication
For years, “turn on MFA” was the single piece of advice security teams could give with total confidence. It stopped the vast majority of credential-based attacks, and organizations rolled it out accordingly. That confidence needs an update. Proofpoint’s 2025 research found that 59% of accounts attackers successfully took over last year had MFA enabled at the time of compromise. Obsidian Security’s incident response data is blunter still: MFA failed to prevent the attack in 84%

