Your company rolled out multi-factor authentication — MFA — last year. You checked the box, sent the all-staff email, and felt good about it. The reality is that MFA, while still worth having, is no longer the security finish line it once was. Attackers have adapted. They have industrialized methods to get past MFA that require no exotic hacking skills, no zero-day exploits, and in many cases, no more than a few minutes of effort. If your security strategy ends at MFA, you have a gap that organized criminal groups and nation-state actors are actively exploiting right now.

This is not a reason to abandon MFA — it is a reason to understand what it cannot do, and to build the layers around it that your business actually needs.

What MFA Was Designed to Stop

Multi-factor authentication adds a second verification step beyond a password. The idea is simple: even if an attacker steals your password, they cannot log in without also having your phone, your hardware token, or your biometric. For years, this worked well enough. Credential stuffing attacks — where attackers buy leaked username and password combinations and try them across hundreds of services — were largely neutralized by MFA.

The problem is that attackers study defenses and engineer around them. In 2026, there are at least four well-documented, actively used techniques to bypass MFA that any mid-sized business needs to understand.

Adversary-in-the-Middle (AiTM) Attacks

An adversary-in-the-middle, or AiTM, attack is the most technically elegant of the bunch. Instead of trying to steal your password and then separately stealing your MFA code, the attacker positions a fraudulent website between you and the real login page — Microsoft 365, Google Workspace, your banking portal, whatever the target is.

Here is how it plays out in practice. An employee receives a phishing email with a link to what looks like a Microsoft login page. The page looks identical because it is, effectively, a live proxy of the real thing. The employee types in their password and approves the MFA prompt on their phone. The attacker's proxy forwards all of this to Microsoft in real time and receives back a valid, authenticated session. The employee lands on their inbox and notices nothing wrong. The attacker now holds a session token — a digital proof-of-identity that lets them access the account without needing the password or MFA code again.

Microsoft's own Threat Intelligence team documented AiTM campaigns targeting tens of thousands of organizations in a single operation. The phishing kit used — Evilginx is one of the most common — is freely available online and requires minimal technical knowledge to deploy.

Email security controls that block the initial phishing message before it reaches an inbox are the most effective first line of defense against AiTM. If the employee never clicks the link, the attack fails at step one.

MFA Fatigue and Push Bombing

This one requires no technical sophistication whatsoever, which is part of what makes it so effective.

Modern MFA often works by sending a push notification to your phone: "Approve this login?" If an attacker already has your username and password — which they can buy for a few dollars on criminal marketplaces — they can trigger that push notification repeatedly. They will attempt to log in dozens of times in a row, flooding your phone with approval requests.

Most people, when they receive repeated unexpected authentication requests, do one of two things. Some approve one just to make it stop. Others call IT and report it, which is the correct response. The attack is betting on the first reaction.

In September 2022, a contractor at Uber approved a push notification after an attacker sent a flood of them, then followed up with a WhatsApp message claiming to be from Uber IT support. The attacker got in. Uber's internal systems were exposed. That same playbook is used against businesses of every size today.

Number-matching MFA — where you must type a code displayed on the login screen into your phone app, rather than simply tapping "approve" — defeats push bombing. If your MFA setup still uses simple approve/deny prompts, that is worth changing immediately.

Device Code Phishing

This technique exploits a legitimate workflow built into identity platforms like Microsoft Entra ID (formerly Azure Active Directory) and Google.

When a device without a browser — a smart TV, a shared terminal, a printer — needs to authenticate to a cloud service, it displays a short alphanumeric code. The user goes to a specific URL on their own device, enters the code, and the original device gets authenticated. This is the "device code flow," and it exists because it is genuinely useful.

Attackers have learned to abuse it. They send a phishing message to an employee — often via email, Teams, or LinkedIn — asking them to visit the device authentication URL and enter a code the attacker provides. The employee believes they are completing a routine IT task. What they are actually doing is handing the attacker a valid authentication token for their account.

Microsoft reported in early 2026 that a Russian threat actor, tracked as Storm-2372, used device code phishing in a sustained campaign against government agencies, defense contractors, healthcare organizations, and energy companies. The targets were not random. The technique was specifically chosen because it bypasses MFA entirely.

Our managed SOC team watches for anomalous authentication patterns — logins from unexpected geographic locations, unusual device codes, off-hours access attempts — that indicate this type of attack is in progress.

Session Token Hijacking

Every time you log into a web application, the server issues a session token. This is the small piece of data, usually stored in your browser, that tells the server "this is the authenticated user." It is why you do not have to re-enter your password every time you click a new page.

If an attacker can steal that token, they inherit your authenticated session — no password required, no MFA required. The session is already valid.

Tokens can be stolen several ways. Malware running on an endpoint can scrape browser session storage. Malicious browser extensions can forward tokens to attacker infrastructure. In certain misconfigured environments, tokens can be intercepted over the network. Infostealer malware — a category of malicious software specifically designed to harvest credentials and session tokens — is available as a service on criminal forums for as little as a hundred dollars a month.

The business impact is direct. A stolen session token for a CFO's Microsoft 365 account gives an attacker access to email, SharePoint, OneDrive, and Teams — a full picture of your operations, finances, and communications, all without triggering any MFA challenge because the authentication already happened.

Endpoint protection and regular penetration testing help identify whether your environment is vulnerable to token theft before an attacker finds out for you.

Why "We Have MFA" Is Not Enough in 2026

The common thread across all four of these techniques is that they do not defeat MFA by cracking it — they route around it. AiTM proxies capture the authenticated session after MFA succeeds. Push bombing manipulates humans into approving MFA themselves. Device code phishing tricks users into completing authentication for the attacker. Session hijacking steals the result of a completed authentication.

This means the defenses that matter are the ones that operate before, around, and after MFA:

Email and messaging security that blocks phishing before it reaches users
Endpoint detection that catches infostealer malware before tokens are exfiltrated
Conditional access policies that evaluate login context — location, device health, time of day — not just credentials
Security awareness training that prepares employees to recognize push bombing and social engineering
24/7 monitoring that catches anomalous authentication patterns and responds before damage compounds

Phishing-resistant MFA — specifically hardware security keys based on the FIDO2 standard, or passkeys — does defeat AiTM and push bombing at the technical level. If your business handles sensitive client data, financial transactions, or regulated information, moving to FIDO2-based authentication is worth the investment.

The Honest Assessment for Business Owners

If someone on your security team or your IT provider told you "we're protected because we have MFA," they were not wrong — but they were not giving you the complete picture either. MFA meaningfully raises the cost of attacking your organization. It still stops the majority of automated credential attacks. It is not optional.

But it is also not a moat. Attackers have adapted. The question to ask your IT team or security provider is not "do we have MFA" but "what happens when MFA is bypassed — how would we know, and how fast would we respond?"

If the answer is uncertain, that uncertainty is the gap.

Our Citadel plan includes managed detection and response, or MDR, which provides the continuous monitoring and response capability that catches post-authentication attacks — the ones that succeed after MFA has been bypassed. If you want to understand whether your current MFA configuration can be bypassed, a penetration test will give you that answer with specifics.

The goal is not to make security sound hopeless — it is not. The goal is to make sure your defenses match the threat environment you are actually operating in, not the one from five years ago. Contact our team to talk through where MFA fits in a layered security strategy built for how attackers actually operate in 2026.

MFA Is Not Enough — How Attackers Bypass Multi-Factor Authentication in 2026