MFA Bypass

MFA bypass is the umbrella term for techniques that get an attacker past multi-factor authentication without possessing the legitimate second factor. Multi-factor authentication remains one of the most effective account security controls — which is precisely why modern intrusions are built around ways to sidestep it rather than break it.

How it works

Most bypasses attack the process around MFA rather than the cryptography inside it. The common families:

• Prompt manipulation. MFA fatigue attacks flood the user with push prompts until one is approved out of exhaustion or confusion.
• Real-time relay. Adversary-in-the-middle phishing kits proxy the genuine login page, capture the one-time code as the victim types it, and steal the resulting session cookie — after which session hijacking makes MFA irrelevant until the token expires.
• Factor replacement. The attacker convinces someone to hand over the factor itself: a help desk agent re-enrolls the attacker's device after a convincing phone call, or a mobile carrier moves the victim's number to the attacker's SIM in a SIM swapping attack. Recovery flows and backup codes are attacked the same way.
• Consent and legacy paths. OAuth consent grants, device code phishing, app passwords, and legacy protocols that never prompt for MFA give attackers a side door that skips the challenge entirely.

Nearly every high-profile identity breach of recent years — Uber, MGM, the Scattered Spider campaigns — used one of these routes rather than a broken authenticator.

How to defend against it

Match the factor to the threat: phishing-resistant methods such as FIDO2 security keys and passkeys defeat both relay and fatigue attacks, and number matching blunts push bombing where passkeys are not yet rolled out. Then harden the paths around the factor — strong identity verification and enforced delays for help desk resets and MFA re-enrollment, no SMS in recovery flows for privileged users, short session lifetimes with revocation on anomaly, and conditional access that blocks legacy authentication. Because most bypasses begin with a human interaction, train and simulate the scenarios employees will actually face; our guide to MFA fatigue attacks covers the most common one in depth, and simulation programs can measure who approves prompts they should refuse.