How Attackers Defeat MFA
Multi-Factor Authentication is essential but not infallible. Understanding bypass techniques helps organizations choose stronger MFA methods and implement compensating controls.
Bypass Techniques
1. Real-Time Phishing Proxies
Tools like EvilGinx2 act as a transparent proxy between the user and the legitimate site:- User enters credentials on phishing page
- Proxy forwards to real site
- Real site prompts for MFA
- Proxy forwards MFA prompt to user
- User enters MFA code
- Proxy captures authenticated session cookie
- Attacker uses the cookie, and MFA is bypassed
Affected: SMS OTP, TOTP apps, push notifications Not affected: FIDO2/WebAuthn (bound to origin)
2. SIM Swapping
Attacker convinces carrier to transfer victim's phone number:- Social engineering carrier support
- Bribed carrier employees
- Exploiting account recovery processes
- Attacker receives all SMS messages
3. MFA Fatigue (Push Bombing)
Repeatedly triggering push notifications until the user approves:- Send dozens of approval requests
- User eventually approves to stop the notifications
- Often combined with social engineering ("IT is fixing your account")
4. SS7 Interception
Exploiting vulnerabilities in the telecom signaling protocol:- Intercept SMS messages in transit
- Requires telecom network access
- More common in targeted attacks by nation-states
5. Token Theft
Stealing authenticated session tokens after MFA completion:- Malware on the endpoint
- XSS vulnerabilities
- Token stored in accessible locations
6. Help Desk Social Engineering
Convincing IT support to reset MFA:- "I lost my phone"
- "I'm locked out and have a deadline"
- Exploiting weak identity verification procedures
MFA Strength Hierarchy
| Method | Phishing Resistant | SIM Swap Safe | Fatigue Safe |
|---|---|---|---|
| SMS OTP | No | No | N/A |
| TOTP App | No | Yes | N/A |
| Push Notification | No | Yes | No |
| Number Matching Push | No | Yes | Yes |
| FIDO2/Passkey | Yes | Yes | Yes |
Recommendations
- Deploy FIDO2/Passkeys for all users (the only phishing-resistant method)
- If using push: enable number matching
- Never use SMS for high-value accounts
- Train help desk on MFA reset verification
- Monitor for MFA fatigue patterns
Where SuperClue Fits
SuperClue cannot see which accounts use weak MFA methods. Its MFA modules check what your public login flow shows and ask for evidence of how MFA is enforced. Use the steps above to move users to phishing-resistant methods.