Multifactor authentication (MFA) has become a fundamental pillar of enterprise security, but its implementation is far from perfect. Despite 87% of large enterprises using it, cybercriminals have developed increasingly sophisticated methods to bypass it. This article provides an in-depth analysis of the most common attack techniques against MFA and offers practical strategies to strengthen it, based on recommendations from experts and official bodies.

The Reality of MFA: Growing Adoption, but with Flaws

Although MFA has proven effective in blocking many attacks, its implementation is often deficient, sporadic, and inconsistent. This not only reduces its effectiveness but also adds friction to user workflows. According to a 2025 JumpCloud survey, 87% of large enterprises regularly use MFA methods, but only a third of small businesses do. More revealing is Cisco's finding: although 87% of respondents consider phishing-resistant MFA essential, less than 20% have implemented such methods.

This gap between perception and practice is a breeding ground for attackers, who exploit any weak point. Recent attacks against Okta in 2023, which compromised its source code on GitHub and its support portal, demonstrate that even the most experienced providers are not immune. The complexity of the modern authentication flow—with multiple devices, networks, and applications—expands the attack surface.

MFA Threat Modalities and Attack Techniques

Attackers have found vulnerabilities in virtually every element of the authentication infrastructure. Below, we break down the main threat categories and their associated techniques, as documented in analyses by experts such as Abnormal Security and KnowBe4.

Multifactor Authentication Fatigue (Push Bombing)

The most well-known technique is MFA fatigue, which involves bombarding the user with push authentication requests until, out of frustration or fatigue, they approve one. This attack was used in the famous Uber case in 2022. MFA fatigue is not limited to mobile devices; it can also exploit weak authentication policies. Ironically, the more an organization uses MFA, the more vulnerable it may be to this type of attack, as users are accustomed to receiving constant notifications.

For this reason, SMS has long been considered an insecure second factor. PayPal, for example, has announced it will eliminate SMS-based MFA by 2026. Experts recommend more robust methods, such as FIDO security keys or biometric data.

Social Engineering and Advanced Phishing

Social engineering remains one of the most effective ways to bypass MFA. Attackers combine SMS phishing (smishing), voice calls (vishing), and SIM swapping to intercept one-time codes. In the case of SIM swapping, the attacker convinces a phone company employee that they are the legitimate owner of the line and redirects SMS to their own device.

Additionally, real-time phishing attacks use malicious proxy servers that relay credentials and MFA codes to the attacker while the user believes they are on the legitimate site. This method, known as 'phishing as a proxy,' has evolved with tools like Evilginx. Account recovery and password reset processes are also exploited, as they often lack a second verification layer.

Cookie Theft and Session Hijacking

Another attack vector is the theft of authentication cookies or session tokens. Attackers can intercept these cookies through malware, man-in-the-middle proxies, or fake login pages. Once the cookie is obtained, they can access the session without needing to pass MFA. The Joomla compromise in 2023 is a clear example: many sites do not enforce inactivity limits, allowing attackers to use stolen cookies for days.

Session hijacking and 'pass-the-cookie' are techniques that exploit this vulnerability. Security teams must implement session expiration policies and monitor anomalous activities.

Attacks on Weak Authentications

Finally, attackers target users and applications that do not use MFA or have weak passwords. The Akira ransomware, for example, infiltrated organizations using Cisco VPNs without MFA through brute-force attacks. The Colonial Pipeline attack in 2021 was due to a single compromised password on a legacy VPN.

Forgotten service accounts or those of former employees are also easy targets. Additionally, attackers can exploit trusted IP addresses or devices to bypass MFA.

Strategies to Stop MFA Attacks

For MFA to be truly effective, organizations must adopt a holistic and proactive approach. Here are six key strategies based on recommendations from CISA, industry experts, and real cases.

1. Understand What You Want to Protect

Before implementing MFA, it is crucial to identify the most valuable assets: email, file servers, remote access systems, and especially identity servers like Active Directory. CISA recommends prioritizing MFA protection for FIDO-compatible systems, including physical security keys and biometric data. However, this recommendation falls short: MFA should extend to the entire enterprise, not just critical systems.

Kevin Surace, CEO of Token.com, warns that MFA without biometric verification is insufficient: "They do not verify the person's identity, but only the possession of a device or credential." In the future, services like Zoom or banking will require real-time biometric data to verify identity.

2. Adopt an Adaptive Authentication Approach

Static authentication, based on a single checkpoint at login, is no longer sufficient. Organizations should opt for adaptive authentication that continuously evaluates risk in real time, dynamically reinforcing security requirements based on user actions. For example, if a user attempts to add a new beneficiary to a bank account, additional verification without a password can be requested.

Microsoft has already implemented conditional access and risk-based authentication to combat token theft and session hijacking. These technologies allow adjusting the authentication level based on context, such as location, device, or behavior.

3. Strictly Control Access Rights

Identity and access management (IAM) is fundamental. Employees should only have access to the resources necessary for their work, and these permissions should be reviewed periodically. Over time, roles change and permissions can become obsolete, creating accounts with excessive privileges that attackers can exploit.

Implementing an access review process, at least quarterly, and removing inactive accounts or those of former employees is essential. Automation tools can help detect and correct these deviations.

4. Conduct Periodic Analysis of MFA Workflow

MFA is not a static solution; it must be continuously reviewed and adjusted. Gerhard Giese, from Akamai, recommended in 2021 to review authentication flows to prevent attackers from discovering valid credentials through web server responses. It is also crucial to implement bot management solutions to prevent credential stuffing attacks.

Conducting penetration tests and attack simulations can reveal vulnerabilities in the MFA flow. Additionally, it is important to stay up to date with the latest attack techniques, as documented in security reports.

5. Review Your Password Reset Workflow

The password reset process is a common weak point. Many websites do not require a second verification in this process, or offer it but do not make it mandatory. Attackers exploit this gap to take control of accounts.

Implementing additional verification (such as a code sent by email or a security question) and setting limits on failed attempts can help. Additionally, avoiding password reuse and using a corporate password manager reduces risk.

6. Ensure Security for High-Value Targets

Not all users have the same level of risk. IT administrators, lawyers, HR managers, and other profiles with access to sensitive data are priority targets for attackers. CISA recommends prioritizing MFA implementation for these groups, as well as for any account with elevated privileges.

Additionally, the use of physical security keys (FIDO2) should be considered for these accounts, as they are resistant to phishing and MFA fatigue. Specific security training for these users is also crucial.

Conclusion: MFA as Part of a Comprehensive Security Strategy

Multifactor authentication is a powerful tool, but it is not infallible. Attackers constantly evolve, so organizations must do the same. Implementing robust, adaptive, and well-managed MFA, along with a strong security culture, is essential to protect digital assets.

At ForgeNEX, we understand that security is a continuous process. Therefore, in addition to these strategies, we recommend integrating MFA with other security solutions, such as session monitoring and identity management. To delve deeper into how automation can improve security, we invite you to read our article on advanced office automation, which shows how observability can be applied to enterprise environments.

If you manage a business in the HORECA sector, our digital menu solution includes security measures to protect your customers' data. And if you are concerned about AI security, do not miss our analysis on Claude's gaps and how to apply security testing to your systems.

MFA is just one piece of the puzzle. Security must be comprehensive, from authentication to access management and continuous monitoring. With the right strategies, you can significantly reduce the risk of your systems being compromised.

Original source: ComputerWorld. Analysis and adaptation by ForgeNEX.