Legacy MFA are solutions such as OTP over SMS and OTP via mobile apps that are 20-year-old technology. While using this technology is better than no-MFA, cybercriminals have developed sophisticated techniques and tools that regularly defeat legacy multifactor authentication (MFA). MFA significantly enhances account security, but not all MFA is created equal, and attackers are exploiting human vulnerabilities resulting in billions of dollars of losses. Here are the most common TTP used by cybercriminals.
Phishing for MFA credentials is the most common bypass method and the one that has scaled furthest with commercial tooling.
The attack starts with a phishing email. The email links to a page that looks identical to a legitimate login portal. When the victim enters their username and password, the attacker’s server relays those credentials to the real site in real time. The real site responds with an MFA challenge. The fake site mirrors that challenge back to the victim.
The victim enters their OTP. The attacker forwards it. The session opens.
The tools that make this accessible are freely available. Evilginx operates as a transparent proxy that sits between the victim and the real site, capturing credentials and session cookies as they pass through. Modlishka works similarly, automating the relay and cookie capture without requiring the attacker to host a fake site from scratch.
The exchange happens within the lifespan of a single OTP. The code is valid. The login is legitimate. The victim never sees the breach.
MFA fatigue attacks exploit the weakest element in any push notification system: the person receiving the push.
The attacker needs credentials first. These are typically purchased from infostealer logs or acquired through an earlier phishing campaign. Once the attacker has a valid username and password, they begin making login attempts in rapid succession. Each attempt triggers a push notification to the victim’s phone.
At 11 pm after a full working day, the twentieth push in an hour gets approved out of exhaustion, confusion or the assumption it is a system glitch. The Uber breach in 2022 followed exactly this pattern. A contractor received repeated push notifications and eventually approved one. The attacker then had access to Uber’s internal systems.
Some attackers add a social engineering layer, calling the victim while the pushes arrive and impersonating IT support to explain why an approval is needed urgently.
A man-in-the-middle attack places the attacker between the victim and the legitimate service, passing traffic in both directions while reading and recording everything.
For MFA bypass, the mechanics are the same as a phishing relay attack, but the framing is architectural. The victim believes they are communicating directly with their bank, email provider, or enterprise application. In practice, every request passes through the attacker’s infrastructure. Credentials, MFA codes, and session cookies are captured as they pass through.
What makes this effective against legacy MFA is timing. A time-based OTP is valid for 30 to 60 seconds. A relay running at network speed captures and reuses it well within that window. By the time the code expires, the attacker has an authenticated session and no longer needs it.
SIM swapping exploits the account recovery processes of mobile carriers rather than any technical vulnerability in SMS itself.
The attack begins with research. The attacker collects enough personal information about the target to impersonate them convincingly. Name, address, last four digits of a payment card, account PIN. This information is often available from previous data breaches, social media or targeted phishing.
Armed with this, the attacker contacts the carrier’s customer support or walks into a retail location. They claim to be the account holder with a lost or damaged SIM and request a transfer to a new card. If the agent is satisfied by the information presented, the transfer completes. All calls and SMS to the victim’s number now route to the attacker’s device.
From that point, any SMS-based MFA code for any account linked to that phone number is intercepted by the attacker. High-value cryptocurrency accounts are the most common target. Enterprise accounts accessed via SMS OTP are equally exposed.
Backup authentication methods are the most reliably exploitable element of any legacy MFA deployment.
The logic is straightforward. The primary factor is the strongest link in the chain. Account recovery exists to handle lost devices, forgotten codes and locked-out users. Recovery paths are built for accessibility, not security. The attacker ignores the primary factor entirely and goes directly to the recovery path.
Email-based recovery is the most common target. If the attacker has already compromised the victim’s email account, any recovery link sent to that address lands with the attacker. Security questions are answered using information scraped from LinkedIn, social media and previous data breaches. Date of birth, mother’s maiden name and first pet are not secrets.
An organisation can deploy strong primary MFA and still be breached through the recovery door. A chain is as strong as its weakest link.
Session hijacking does not bypass MFA. It renders it irrelevant after the fact.
When a user successfully authenticates, the server issues a session cookie. This cookie is the proof that authentication already happened. As long as the cookie is valid, the user does not need to authenticate again. The session cookie is the access credential.
Attackers who steal a valid session cookie inherit everything the legitimate user had access to. They never trigger an MFA challenge because they are not logging in. They are resuming a session that is already authenticated.
Session cookies are obtained through malware, cross-site scripting vulnerabilities, or tools like Evilginx that capture cookies as they pass through the relay. In the 2023 MGM Resorts attack, attackers used social engineering to gain initial access and then moved laterally using captured session tokens, avoiding the need to re-authenticate at each step.
Extended session durations traded for convenience are extended attack windows for an attacker who has captured a cookie.
Social engineering bypasses technical controls by targeting the person operating them.
The IT helpdesk impersonation is the most direct form. The attacker calls the victim, identifies as IT support and presents a plausible reason why they need the MFA code immediately. A security incident. A system migration. A compliance check. The victim complies because the request sounds legitimate and carries apparent authority.
Vishing campaigns automate the first stage of this. Automated calls prompt the victim to press a key to speak with IT support. A real attacker then takes over and drives the interaction to obtain the OTP.
Real-time social engineering on video calls is an increasingly documented variant. A caller poses as a colleague, vendor or executive and asks the victim to share their screen or enter a code while the attacker watches.
The consistent factor across all of these is that the victim does not know they are the target. The deception is the attack. No technical control addresses it while human judgment remains the final authentication gate.
There are several other attack methods that hackers use to bypass legacy MFA. These include Brute Forcing MFA Codes, Malware and Keyloggers, Using Stolen Recovery Codes, and API Exploitation. Phishing-resistant authentication built on FIDO2 and hardware-bound credentials is not vulnerable to any of these attacks. It removes the credential an attacker would need to steal.