Multi-factor authentication has become the default recommendation for securing accounts, and rightly so. It stops the vast majority of credential-based attacks dead in their tracks. But treating MFA as a complete solution rather than one layer in a defence-in-depth strategy creates a false sense of security that attackers are increasingly exploiting.
MFA bypass techniques have matured significantly. What used to require nation-state capabilities is now available as off-the-shelf tooling. Understanding how these bypasses work helps you implement MFA in a way that resists them.
Adversary-in-the-Middle Attacks
Tools like Evilginx2 act as a reverse proxy between the victim and the legitimate login page. The user sees the real login page, enters their credentials and MFA code, and everything gets relayed to the real service. The attacker captures the session token that comes back and uses it directly, bypassing MFA entirely.
This technique is effective against time-based one-time passwords and push notifications. The user thinks they’ve logged in normally. The attacker has a fully authenticated session.
William Fieldhouse, Director of Aardwolf Security Ltd, comments: “MFA is essential, but it’s not infallible. We’ve demonstrated MFA bypass through adversary-in-the-middle proxies, MFA fatigue attacks, and SIM swapping during real engagements. Organisations need to understand these bypass techniques and implement phishing-resistant MFA methods like FIDO2 keys where possible.”
MFA Fatigue and Social Engineering
Push-based MFA sends a notification to the user’s phone asking them to approve or deny a login attempt. MFA fatigue attacks bombard the user with repeated push notifications until they approve one just to make it stop. Sometimes the attacker follows up with a call pretending to be IT support, asking the user to approve the notification to ‘fix a system issue’.
Number matching and additional context in push notifications help, but they don’t eliminate the risk entirely. A tired, distracted, or pressured employee can still approve a malicious request.
Choosing the Right MFA Method
FIDO2 security keys and passkeys provide the strongest protection against phishing because they bind the credential to the specific domain. An adversary-in-the-middle proxy using a different domain can’t relay a FIDO2 assertion. The authentication simply fails.
For organisations that can’t deploy hardware security keys universally, authenticator apps with number matching provide a reasonable middle ground. SMS-based MFA should be treated as a last resort due to SIM swapping risks.
Testing MFA Implementation
During web application penetration testing, testers evaluate not just whether MFA is present but how it’s implemented. Can it be bypassed through token theft? Are there endpoints that don’t enforce it? Does the application fall back to password-only authentication under certain conditions?
Combining MFA testing with regular vulnerability scanning services ensures that both your authentication mechanisms and the underlying infrastructure remain secure. MFA is important. Implementing it correctly and testing it regularly is what makes it effective.
