Research
Multi-factor authentication, or MFA, makes accounts much harder to break into.
Instead of relying on a password alone, MFA asks the user to prove their identity a second way. That might mean approving a notification, entering a code, or using another authentication method.
But attackers have learned how to work around it.
They may trick the user into completing MFA for them, get between the user and the real login page, or convince IT to reset MFA altogether.
These are often called MFA bypass attacks.
The important thing to understand is that attackers usually aren't "breaking" MFA. They're finding another way to get through the login process.
How attackers get past MFA
1. They trick the user into approving the login
Imagine an attacker already has someone's password.
They try to log in, which sends an MFA request to the employee's phone. The employee ignores it.
Then another request appears.
And another.
Eventually, the employee may approve one because they think it's a system error or simply want the notifications to stop.
This is often called MFA fatigue or push bombing.
The attacker hasn't defeated MFA. They've convinced the real user to approve the login for them.
2. They put themselves between the user and the real login page
Some phishing pages do more than steal passwords.
They can sit between the employee and the real Microsoft, Google, or other login page.
The employee enters their password and completes MFA as usual. Behind the scenes, the fake page passes that information to the real service in real time.
Once the login succeeds, the attacker may be able to take over that signed-in session.
This type of attack is called adversary-in-the-middle phishing, or AiTM.
The name sounds technical, but the idea is simple: the attacker puts themselves in the middle of the login process.
3. They get the help desk to reset MFA
Some attackers skip the login page and go after the help desk instead.
The attacker calls IT pretending to be an employee. They may already know the employee's name, job title, manager, or other information that makes the story sound believable.
They say they lost their phone, got a new device, or can't access their account.
If IT resets the employee's MFA without verifying the request carefully enough, the attacker can register their own device and sign in as the employee.
From that point on, the login can look legitimate because the attacker's MFA method is now attached to the real account.
Microsoft has documented attackers using this exact approach to convince help desks to reset passwords or register new MFA devices.
MFA can't be the only check
MFA is still an important part of account security. It creates another barrier when a password is stolen.
But these attacks show why access decisions can't depend on MFA alone.
Imagine an employee normally signs in from an approved laptop during working hours.
Now the same account is trying to sign in at 2:41 a.m. from an unknown network and a device the company has never approved.
Even if the password and MFA are correct, there are still reasons to question that login.
This is where conditional access adds another layer.
Conditional access simply means checking more than the password and MFA request before allowing someone in.
A company might ask:
Is this an approved device?
Is the user connecting from an expected network?
Is the login happening at an unusual time?
Should this user have access to this application?
If the request doesn't meet the company's rules, access can be denied.
HENNGE Identity allows MSPs to apply these types of access policies and use device certificates to identify approved devices. Instead of relying on MFA as the final decision, the login also has to meet the client's access rules.
Use layers, not one line of defense
There's no single setting that stops every MFA bypass attack.
A stronger approach combines multiple layers: MFA, stronger authentication methods where appropriate, well-trained users and help desk staff, and access policies that consider the device, network, time, and other conditions around the login.
For MSPs, this also means looking beyond whether a client simply "has MFA."
The better question is whether an attacker who gets past that first layer still has an easy path into the account.
Takeaway
MFA bypass attacks have changed the way we need to think about login security.
Attackers may convince users to approve a request, place themselves in the middle of the login process, or manipulate the help desk into resetting MFA entirely.
MFA still makes accounts safer. But it shouldn't be the final security check.
Conditional access adds another decision before access is granted: Does this login make sense under these conditions?
That extra context can stop a suspicious login even when the password and MFA appear correct.
Not sure whether your clients' current login controls are enough? Get a free 30-minute Cybersecurity Review with HENNGE to identify gaps in MFA, device checks, and access policies.
