For years, “turn on MFA” was the single piece of advice security teams could give with total confidence. It stopped the vast majority of credential-based attacks, and organizations rolled it out accordingly. That confidence needs an update. Proofpoint’s 2025 research found that 59% of accounts attackers successfully took over last year had MFA enabled at the time of compromise. Obsidian Security’s incident response data is blunter still: MFA failed to prevent the attack in 84% of the incidents they investigated. MFA bypass attacks haven’t replaced phishing, they’ve absorbed it, becoming the default follow-through once a credential is captured.
Why This Happened: MFA Became Worth Routing Around
Attackers go where the return on effort is highest. When MFA was rare, stealing a password was enough. Once MFA became standard, the economics shifted: rather than find a new way in, malicious developers built commodity toolkits that defeat MFA directly, then rented them out to anyone willing to pay. That shift is now mature, well-funded, and, per Proofpoint’s data above, succeeding often enough to be the primary account-takeover method rather than an edge case.
Three techniques account for most of what’s actually happening in the field right now.
1. Adversary-in-the-Middle (AiTM) Phishing Kits
This is the big one. An AiTM kit sits a fake login page between the victim and the real service, Microsoft 365, Google Workspace, whatever the target uses, and relays everything in real time. The victim types their password and MFA code into what looks like the legitimate site; the kit passes those credentials straight through to the real service, then captures the resulting authenticated session cookie. From that point, the attacker has a live, already-authenticated session and doesn’t need the password or the MFA code ever again, not even after the victim changes their password, unless the session itself is explicitly revoked.
Microsoft’s security team published a detailed breakdown of Tycoon2FA, one of the most widely used AiTM kits, in March 2026. The scale is what makes it notable: the platform was targeting more than 500,000 organizations monthly, sending tens of millions of phishing messages across nearly every sector, education, healthcare, finance, government, nonprofits. Access to the kit itself started at $120 for a 10-day panel license, or $350 a month. This isn’t a nation-state capability anymore; it’s a subscription product with customer support, built specifically to relay SMS codes, one-time passcodes, and push-based approvals straight through to the real authentication server, rendering all three effectively useless against it. Operators rotate infrastructure every 24–72 hours and use randomized CAPTCHA pages and heavy obfuscation specifically to dodge automated detection.
The broader numbers back up how fast this category is growing: Push Security tracked a 37.5x increase in device-code phishing pages by April 2026, Huntress recorded a 1,380% jump in AiTM detections between the second half of 2025 and early 2026, and Cofense measured 67% year-over-year growth in credential phishing volume through 2025. SpyCloud separately reported recovering 8.6 billion stolen session cookies and related session artifacts from criminal marketplaces in 2025 alone, a scale that makes clear session theft, not password theft, is now the primary currency.
2. MFA Fatigue (Push Bombing)
The lower-tech cousin of AiTM: once an attacker has a valid password, they trigger repeated push notification prompts to the victim’s phone, sometimes dozens in a row, sometimes timed for 2 a.m. betting that irritation, confusion, or simple habit will eventually produce an “Approve” tap. CISA has flagged this technique specifically because it requires no custom infrastructure at all, just a stolen password and patience. It remains effective mainly against push-based MFA with no number-matching or contextual detail shown to the user.
3. Helpdesk and SIM-Swap Style Factor Resets
The third technique skips technical MFA bypass entirely and goes after the process for resetting it. This is the playbook made infamous by the threat group Scattered Spider in the 2023 MGM Resorts and Caesars Entertainment attacks, and it just became legal record: on June 23, 2026, two Scattered Spider members pleaded guilty on the first day of their UK trial, one of them previously identified by U.S. prosecutors as having given media interviews after the MGM breach.
The method was almost embarrassingly simple. An attacker called MGM’s helpdesk, claimed to have lost their phone and been locked out of their work account, and supplied an employee’s name and job details gathered from public sources like LinkedIn. The helpdesk agent reset that employee’s MFA and pointed the new authentication factor at a phone number the attacker controlled. From there, it took roughly an hour for the attackers to pivot into MGM’s core systems and encrypt the property-management servers. MGM’s losses exceeded $100 million; Caesars, targeted with the same technique, paid an estimated $15 million ransom rather than risk a similar shutdown.
This technique hasn’t gone anywhere since 2023, coverage of the guilty plea notes the same helpdesk-vishing approach is still attempted against Australian businesses on a weekly basis. It works because organizations spend heavily on hardening the authentication technology itself while leaving the human process for resetting it comparatively unguarded.
Why "We Have MFA" Isn't the Reassurance It Used to Be
Put these three together and the pattern is clear: none of them require breaking cryptography or defeating MFA in any technical sense. AiTM kits relay valid credentials and steal the resulting session. Push bombing exploits human patience, not the push protocol. Helpdesk resets exploit a verification gap in a support process, not a flaw in the authenticator app. MFA bypass attacks succeed by treating multi-factor authentication as a process to be routed around rather than a wall to be broken through, which is exactly why “we require MFA” no longer functions as a satisfying answer to “how are you protected.”
What Actually Reduces This Risk
Not all MFA is equally vulnerable, and the fixes here are concrete rather than aspirational:
- Move to phishing-resistant MFA wherever possible. FIDO2 security keys, Windows Hello for Business, and passkeys are cryptographically bound to the legitimate site’s domain, which means an AiTM proxy simply cannot relay the authentication the way it does with SMS, OTP, or push. Microsoft reports phishing-resistant MFA blocks over 99% of identity-based attacks. Adoption is climbing fast, the FIDO Alliance estimates roughly 5 billion passkeys now in active use, with about 75% of people having enabled one somewhere, but most organizations still default to weaker methods for everyday logins even after enabling stronger options for admins.
- Prioritize phishing-resistant MFA for admin and privileged accounts first, since those are the accounts an AiTM kit operator is specifically hunting for once inside a mailbox.
- Enable number-matching and contextual detail on push notifications and treat a flood of unexpected approval requests as an active-incident signal, not background noise to dismiss.
- Lock down your own helpdesk’s identity-verification process before an attacker tests it for you. A callback to a pre-registered number, a manager confirmation, or a video check for any MFA-factor reset closes the exact gap Scattered Spider used against MGM and Caesars.
- Monitor and revoke sessions, not just passwords. Since AiTM attacks steal live session tokens, a forced password reset alone does nothing if the underlying session isn’t also invalidated. Conditional Access policies that re-evaluate session risk continuously, not just at initial login, are what actually close this gap.
- Update your tabletop exercises and IR runbooks to include an MFA-bypass scenario explicitly. If your incident response plan assumes “MFA was in place” means the account is safe, the Scattered Spider and Tycoon2FA cases above show exactly how wrong that assumption can be.
Find Out Where Your MFA Would Actually Hold
MFA bypass attacks are now a routine part of the incidents CyberClan’s response team works, not an edge case. If you’re not certain whether your organization’s authentication setup would withstand an AiTM kit, a push-bombing campaign, or a helpdesk-vishing attempt, that’s worth finding out before an attacker does. Schedule a Cyber Resilience Assessment or download our Phishing-Resistant MFA Implementation Guide to benchmark where you stand.
Seeing a wave of unexpected MFA prompts, or suspect an account was taken over despite MFA being enabled? Call our 24/7 emergency hotline now.
