MFA still stops the attack it was built to stop, and attackers have moved past it. Multi-factor authentication (MFA) was designed to defend the login. Attackers now target the session that exists after the login succeeds, which means the control fires correctly and the intrusion happens anyway.
The reason is where work happens. Cloud productivity suites, analytics platforms, enterprise ERP systems, and nearly every application in between now live inside the web browser. The browser is the interface for getting work done, which makes it the interface attackers study hardest. Security tooling built for the network layer and the endpoint has visibility on either side of the browser session, but very little inside it.
That gap is where MFA bypass lives. Threat actors use evasive techniques that defeat the inspection performed by Secure Web Gateways, malicious link analysis, anti-malware scanning, sandboxing, network traffic analysis, and domain categorization. These attacks move faster than detection-based tooling can keep pace with, and because they execute inside the browser, defenses that do not reach into the browser are unlikely to see them at all.
The data supports this plainly. Cisco Talos Incident Response found that authentication abuse appeared in 65% of the engagements it handled in Q2 2026, up from 35% the previous quarter, with attackers defeating MFA through adversary-in-the-middle proxies, session token theft, push fatigue, and attacker-registered devices (Cisco Talos, 2026).
MFA bypass attacks are techniques that circumvent the additional authentication layers MFA provides, such as one-time passwords, digital tokens, or biometrics, to reach sensitive data and systems. Also described as single sign-on (SSO) impersonation, these attacks exploit the trust organizations place in SSO providers such as Okta, LastPass, and OneLogin to reach multiple connected services from a single point of compromise.
Attackers reach that point using social engineering, phishing, and exploitation of weaknesses in the authentication process itself. Each technique targets one of the three components MFA relies on: the password (something the user knows), the token (something the user has), or the biometric (something the user is).
This is one category of highly evasive attack technique. As MFA adoption has climbed across consumer and enterprise authentication, attacker investment in defeating it has climbed with it, and the returns have been substantial.
Three techniques account for most MFA bypass activity: push fatigue, adversary-in-the-middle, and token theft. Each one works differently, and each one ends in the same place, with an attacker holding a session the organization believes belongs to a trusted user.
MFA fatigue begins after attackers already hold valid credentials. They attempt repeated logins to the target account, and every attempt fires another push or SMS verification request at the user. For organizations where push approval is the second factor, the user is bombarded until frustration or simple inattention produces an approval, and the attacker is in.
The technique has escalated considerably. Attackers now pair the notification flood with AI voice cloning and deepfake video, impersonating IT support staff and walking victims through fraudulent authentication steps in real time while the prompts arrive. The social engineering and the technical attack now run simultaneously, which makes the fraudulent request far harder for a user to distinguish from a legitimate one.
Adversary-in-the-middle attacks, also called session hijacking or real-time phishing, place a malicious reverse proxy between the user and the legitimate login page. When attackers only needed a username and password, a static fake login page was sufficient. With MFA widely deployed, they need the credential and the second factor together, in real time.
The proxy delivers both. Victims typically receive an out-of-band request to authenticate, through SMS or email, that routes them through the attacker's proxy server to the genuine login page. Everything the user sees is real, because it is real, relayed through infrastructure the attacker controls. Credentials pass through, the MFA challenge is satisfied, and the attacker captures the resulting session cookie and replays it immediately.
The scale this reached is worth understanding. By mid-2025, a single Phishing-as-a-Service platform called Tycoon 2FA accounted for roughly 62% of all phishing attempts Microsoft blocked, including more than 30 million fraudulent emails in a single month. Microsoft, Europol, and partners seized 330 of its domains in March 2026, by which point the platform was linked to an estimated 96,000 victims worldwide (Microsoft, 2026).
Token theft targets the session cookies stored on a device so users do not have to re-authenticate throughout a session. Attackers steal the cookie, load it into their own browser session, and the application accepts it as proof that the trusted user has already authenticated. No password is required, no MFA challenge is issued, and the attacker inherits everything that user was permitted to do.
This has become the dominant objective rather than a secondary prize. Researchers analyzing infostealer logs traded on dark web forums and Telegram marketplaces identified more than 52.4 billion stolen browser cookies over a single year, appearing 4.6 times more frequently than passwords, files, and payment card records combined (NordVPN, 2026). Cookie theft also breaks the standard response playbook, because rotating a password does nothing to a stolen session. The session stays valid until it is explicitly revoked or expires on its own.
Recent incidents show each technique operating at a different scale, from a single targeted deepfake call to an industrialized criminal service.
Traditional tools miss these attacks because they were built to inspect the network and the endpoint, and these attacks execute inside the browser session. Content categorization engines, URL filtering, secure email gateways, and anomaly detection all evaluate signals that sit outside the moment of compromise. By the time a user is typing credentials into an attacker-controlled proxy, the decision point has already passed.
The problem compounds on unmanaged devices. Many endpoints involved in these incidents were personal machines the enterprise security team never provisioned or monitored, carrying little to no protection while accessing the same corporate applications as managed hardware.
This is why we classify these threats as Highly Evasive Adaptive Threats (HEAT). HEAT techniques are defined by their ability to evade the detection-based tooling organizations have deployed, and by their focus on the one application every knowledge worker uses all day.
Organizations prevent MFA bypass by adding a control layer inside the browser, where these attacks actually execute. Identity controls remain necessary, and phishing-resistant factors such as passkeys and FIDO keys raise the cost of an AiTM attack considerably. Neither addresses a stolen cookie replayed from an attacker's machine, because that cookie represents an authentication that already succeeded.
Attackers adjust in real time, now combining voice cloning, deepfake impersonation, and industrial-scale PhaaS infrastructure in single campaigns. Defenders need controls that adjust with them, enforced at the point where the attack lands rather than at the perimeter it already crossed.
The Menlo Browser Security Platform is built to close this gap. Patented Adaptive Clientless Rendering (ACR) technology executes high-risk web content in the Menlo Cloud rather than on the user's device, which means an AiTM proxy, a fatigue campaign, or a cookie theft attempt is neutralized before it reaches the browser the user is working in. That protection holds whether the endpoint is managed, unmanaged, or personally owned, which matters because the unmanaged devices are the ones attackers keep finding.
What Is an MFA Bypass Attack?
An MFA bypass attack is a technique used to circumvent multi-factor authentication and reach systems and data without defeating the underlying cryptography. Common methods include MFA fatigue, adversary-in-the-middle (AiTM) attacks, session token theft, and attacker-registered devices. Each exploits a human or session-layer weakness that MFA was never designed to cover.
What Is MFA Fatigue?
MFA fatigue is an attack in which threat actors who already hold stolen credentials repeatedly trigger push notifications on a victim's device until one is approved out of frustration or inattention. The technique now frequently runs alongside AI voice cloning, with attackers impersonating IT support staff and coaching victims through the fraudulent approval while the prompts arrive.
What Is an Adversary-in-the-Middle (AiTM) Attack?
An AiTM attack places a malicious reverse proxy between the victim and a legitimate login page, capturing both the credential and the MFA token in real time and replaying them immediately. Because the victim interacts with the genuine login page relayed through attacker infrastructure, nothing looks wrong. Commercial kits such as EvilGinx and Tycoon 2FA made the technique available to attackers with no technical expertise.
How Does Token Theft Bypass MFA?
Token theft exploits the session cookies a browser stores after authentication succeeds. Attackers obtain these cookies through infostealer malware, browser exploits, or AiTM interception, then replay them from their own browser to access corporate systems without ever facing an authentication prompt. Researchers identified more than 52.4 billion stolen browser cookies circulating in infostealer logs over a single year (NordVPN, 2026).
How Does Menlo Security Stop MFA Bypass Attacks?
Menlo's HEAT Shield AI identifies and blocks evasive phishing sites, including AiTM proxy pages, at the point of click by analyzing the full page DOM, JavaScript execution, and domain intelligence together. Because web content executes in the Menlo Cloud rather than on the device, credential harvesting pages, proxy interception, and cookie theft attempts are neutralized before they can act on the user's session. You can read more about how Menlo addresses zero-day phishing.
About the Author
Neko Papez is a Cybersecurity Strategist at Menlo Security, specializing in browser-based threat prevention. With a career spanning industry leaders like Proofpoint, Domo, and now Menlo, Neko bridges the gap between complex security architecture and business-driving product marketing. Neko has a proven track record of helping enterprises combine deep technical expertise with a sharp marketing lens to deliver impactful thought leadership and robust defense frameworks for the world's most targeted enterprises.
Secure your enterprise from MFA bypass attacks with Menlo Security. Schedule a demo here.
Menlo Security
