How attackers get past login codes and MFA

In every attack on this page, the victim had MFA switched on and the attacker still got in. None of them broke the MFA. They got a person to approve it, moved the phone number it relied on, talked someone into handing it over, or stole the proof that it had already been passed. After one large campaign, Microsoft put it plainly: “this is not a vulnerability in MFA” [9].

MFA, multi-factor authentication, means proving it’s you in more than one way. Usually that is a mix of something you know, like a password, something you have, like a phone or a security key, and something you are, like a fingerprint or your face. Two of them together is two-factor authentication (2FA). A text message code, a push notification, an authenticator app and a physical security key all count. As Bradley says in the video, they don’t all give you the same level of protection.

The video’s description also lists session hijacking with stolen cookies as a fifth route. It is where the phishing proxy ends up, so it is covered in that section, with a real case where malware stole the cookie instead.

This attack starts with the attacker already holding your password. That part is easier than people think. Bradley’s example: you use one favourite password, say whitemonsterrocks23, on lots of sites. One of them, call it notquitemonster.com, gets breached. Attackers then try that email address and password on other sites, and where it works, the only thing left in the way is the MFA prompt.

So they set it off, again and again. Each attempt sends a push notification to your phone asking you to approve a sign-in. They keep going until you accept, out of confusion, out of annoyance, or because you assume it is your own device. Bradley has seen attackers send these prompts at around 9am, when people are logging in for work and one more prompt looks normal. Some people take a prompt for their VPN, the secure connection to the office network, dropping out, and approve it.

Uber, September 2022. Uber says the attacker probably bought a contractor’s Uber password on the dark web, after malware on the contractor’s personal device exposed it. The attacker then tried to log in to the contractor’s account again and again. Each time the contractor got a two-factor approval request, and eventually accepted one [5]. Uber linked the attacker to the Lapsus$ group. No clever technique was needed: one of the requests just had to be accepted.

The fix: number matching. Instead of a bare Approve button, the login screen shows a number and the app asks you to type it in. Someone being spammed from a stranger’s login attempt never sees that number, so they can’t approve it. Microsoft switched number matching on for every Microsoft Authenticator push notification in May 2023, and users can’t turn it off [6] [7]. NIST’s current guidelines say the same thing from the other side: a prompt that only asks you to approve is no longer acceptable, because people approve them to make fatigue attacks stop [4].

A lot of people think a code sent by text message is tied to their phone. It isn’t. It is tied to the phone number. In a SIM swap, the attacker convinces the mobile phone company to move that number onto a SIM card they control. From then on your texts, your password reset links and your one-time codes go to them instead of you.

That is why it is worse than losing one account. It attacks the thing your 2FA depends on, so every account that sends codes or reset links to that number is open to them.

Joseph James O’Connor. The US Department of Justice says O’Connor and his co-conspirators carried out SIM swap attacks on at least three executives of a cryptocurrency company and stole crypto worth at least about $794,000 at the time. Separately, he took part in the July 2020 Twitter hack. He was sentenced to five years in prison on 23 June 2023 [8].

The fix. Don’t use text messages as the main protection on high-value accounts if you can avoid it. Put a PIN or password on your mobile account with your network, and move important accounts to an authenticator app, or better, a passkey or hardware security key. CISA calls text and voice codes a last resort [2], and NIST now treats phone-network codes as a restricted option that services must offer an alternative to [4]. As Bradley puts it, the problem isn’t only that SMS is old. It relies on a third party not being talked into giving your identity away.

Old phishing was basic: a fake login page collected your password, and you might notice straight away that something was wrong. A phishing proxy is smarter. The attacker’s site sits between you and the real website and passes everything through in real time. Security teams call this adversary in the middle (AiTM).

Microsoft, 2022. Microsoft’s threat intelligence team described one AiTM campaign that had tried to target more than 10,000 organisations since September 2021. It used the open-source Evilginx2 phishing kit to copy the Office online sign-in page and stole passwords and session cookies. In some cases the attackers began payment fraud from the victim’s mailbox as little as five minutes after stealing the session, and set inbox rules that hid replies from the people they were defrauding [9].

Mandiant, Google’s incident response firm, puts it in one line: stealing the session token is the same as stealing the signed-in session, so the attacker never has to face the MFA challenge [10].

Bradley’s comparison in the video is airport security. Your password gets you to the checkpoint and MFA gets you through. The attacker then steals the wristband that proves you already passed, and walks around inside without ever queueing. They even hand you a copy, so you don’t know anything has happened. Your password wasn’t the weak point. The attacker stole the proof that you had already passed the checks.

When there is no fake page at all. The same cookie can be taken straight off a computer. In December 2022, malware on a CircleCI engineer’s laptop stole a valid, 2FA-backed single sign-on session, and the attacker used it to act as that employee from somewhere else. CircleCI’s antivirus didn’t detect the malware [11]. It ends in the same place as the proxy: a session that has already passed MFA, in the wrong hands.

The fix. The strongest answer is phishing-resistant MFA, which means passkeys or hardware security keys. They are tied to the real website’s domain, so a fake site can’t relay the login. Microsoft says passkeys are almost impossible to phish, because a passkey only works on the site or app it was created for [13]. The same kind of real-time phishing hit Cloudflare in 2022: three employees entered their passwords on a lookalike page, but every Cloudflare employee uses a FIDO2 security key, so the attacker got nowhere [12]. Against replayed cookies, Microsoft also recommends Conditional Access rules, such as requiring a compliant device or a trusted IP address [9]. One limit: Mandiant notes that hardware keys only protect you while the device itself isn’t compromised [10].

Sometimes the cleanest way round a security system is not to beat it. It is to find where a person is involved and get them to change it for you. For MFA, that person is often on the IT help desk, the team that resets passwords and registers new phones.

Twitter, July 2020. New York’s Department of Financial Services (NYDFS) investigated. On 14 July 2020 the attackers phoned several Twitter employees, claimed to be calling from the help desk in Twitter’s IT department, and said there was a VPN problem. They sent the employees to a fake VPN login page on a similarly named domain. As each employee typed in their details, the attackers entered them into the real Twitter site. That generated an MFA notification, and some employees approved it [14]. In all, 130 Twitter accounts were compromised and about $118,000 in bitcoin was stolen [14].

The NYDFS report is direct about MFA. Twitter used app-based MFA. The report says the most secure form is a physical security key, that hardware MFA would have stopped the hackers, and that Twitter was moving to it [14]. Strictly, the Twitter attackers posed as the help desk rather than tricking it, and the fake page worked like the proxy in Route 3. The lever was the same: a trusted support role used to get MFA approved.

MGM Resorts, September 2023. Reuters reported, citing two sources, that MGM was targeted by a hacking group called Scattered Spider. Digital room keys and mobile check-in stopped working, and hotels handed out physical keys instead [15]. MGM later told US regulators it expected the attack to cut its third-quarter results by about $100 million [16].

CISA and the FBI describe how this group works. Scattered Spider members pose as IT or help-desk staff by phone or text, and convince help-desk staff to reset passwords or move an employee’s MFA to a device the attacker controls. The same advisory lists SIM swaps and repeated MFA prompts among the group’s techniques too [19].

The fix is partly technical and partly process. From the video: restrict who can reset MFA, and restrict where MFA can be registered from. Require trusted devices and trusted locations, stronger identity checks, and escalation for sensitive changes. If your help desk can be socially engineered, your MFA rollout isn’t as secure as you might think.

Each route leaves traces in Microsoft Entra ID, Microsoft’s cloud directory, and in Microsoft Defender XDR. Several of the detections and the hunting table below need Entra ID P2 or higher licences, so check what your tenant can see before you rely on any of them [20] [21].

Hunting for a replayed session. Microsoft found that when an attacker replays a cookie stolen by an AiTM proxy, the session ID is the same one created when the victim signed in through the proxy [9]. In Defender XDR advanced hunting, the EntraIdSignInEvents table holds Entra ID sign-ins with their session ID, IP address and country. It replaced the AADSignInEventsBeta table that Microsoft’s 2022 queries used [21]. This query lists successful sessions seen from more than one country in the past week:

Travel and VPNs will produce false positives. Read the IP addresses and apps side by side before calling anything malicious. Entra ID Protection’s own detections are the second check, using the names Microsoft gives them in the RiskEventTypes column [20] [21]:

Microsoft saw the AiTM attackers create inbox rules to hide replies [9]. New rules appear in the CloudAppEvents table. Read them against the sessions found above:

These are in the Microsoft Entra admin center, with names as Microsoft’s documentation gives them in November 2026. Microsoft’s own pages differ on whether Authentication methods sits directly under Entra ID or under Entra ID > Security, so the paths below start at Authentication methods or Conditional Access.

None of these settings stops a help desk that resets MFA on a convincing phone call. Keep the list of people who can reset MFA short, check identity properly before any reset, and escalate any change to an admin account, as the video recommends.

For your own accounts:

• If a login prompt appears that you didn’t start, deny it and change that account’s password. Someone already has it.
• Use a different password on every site, so one breached site doesn’t hand over the rest. A password manager makes that practical.
• Add a passkey or security key to your email and to any account that holds money.
• Once something stronger is set up, remove text-message codes as a backup, and put a PIN on your mobile account.
• Never sign in from a link in an unexpected email, text or phone call. Open the site yourself.

For a company:

• List every MFA method switched on in Entra ID or Google Workspace, and who each one applies to.
• Confirm admin accounts can only sign in with phishing-resistant MFA.
• Run the session query above over the last 30 days and read every result.
• Ask the help desk to walk you through exactly what they check before resetting someone’s MFA.
• Check Report suspicious activity is switched on and that someone reads the alerts.

By far the best protection against all four routes is phishing-resistant MFA, typically a hardware security key such as a YubiKey. Bradley recommends having at least three: one for normal use, one as a backup, and one more in case you somehow lose the other two. CISA says phishing-resistant MFA is the standard organisations should strive for [1]. Microsoft says passkeys are almost impossible to phish [13]. Mandiant recommends hardware-based MFA and FIDO2 against modern session stealing [10].

Any 2FA is better than no MFA. If your second factor could be spammed, phished, rerouted, socially reset or worked around with a stolen session, there is room for improvement. Good MFA still matters. Great MFA just matters more.

Bradley Carpenter, in the video