What attackers steal instead
When you sign in, the website hands your browser a session cookie: a small token that says “this person has already logged in, MFA and all”. Every click after that shows the cookie, not your password or your code. Whoever holds it is treated as you until it runs out.
That is the trick in the short. The attacker’s website sits between you and the real one. It passes your password and your code along, and keeps the cookie the real site sends back. You see a normal login. They get a session that has already passed MFA. This is called an adversary-in-the-middle (AiTM) attack.
Security teams will know the idea from office networks. A stolen Kerberos ticket, the token Windows networks use after a sign-in, works for whoever presents it, which is what pass-the-ticket attacks rely on. A stolen session cookie is the web version.
Five ways round it, five real cases
The short covers the first route. Bradley’s longer video covers the rest. Each one has worked against a real company.
- Fake login page in the middleMicrosoft, 2022: one campaign targeted more than 10,000 organisations, stole passwords and session cookies, and began payment fraud from a victim’s mailbox in as little as five minutes [1].
- Cookie-stealing malwareCircleCI, December 2022: malware on an engineer’s laptop stole a signed-in session that had already passed 2FA. Its antivirus didn’t detect the malware.
- Push fatigueUber, September 2022: an attacker with a contractor’s password kept trying to log in. The contractor got an approval request each time, and eventually accepted one.
- SIM swapJoseph James O’Connor, sentenced 2023: a SIM-swap attack on executives of a cryptocurrency company stole crypto worth about $794,000 [5]. He also took part in the 2020 Twitter hack.
- Help-desk social engineeringCaesars Entertainment, September 2023: told US regulators the attack on its network came from social engineering of an outsourced IT support vendor.
Cookie-stealing malware skips the fake page altogether. It reads the cookie straight out of the browser on an infected computer. CircleCI said the attacker then used it to act as the engineer from somewhere else.
Push fatigue, also called push bombing, means sending login prompt after login prompt until the person taps Approve to make it stop. Uber said its attacker had probably bought the contractor’s password after malware on a personal device leaked it.
A SIM swap moves your phone number onto a SIM card the attacker controls. From then on your texts and calls, login codes included, go to them. That is why CISA and the UK’s NCSC both put text codes at the bottom of their MFA rankings.
Help-desk social engineering skips the technology. CISA, the US cyber security agency, says the group it tracks as Scattered Spider phones IT help desks pretending to be staff, and talks them into resetting passwords or moving the employee’s MFA to a device the attacker holds.
What stops each one
- Passkeys and security keysStop the fake login page, push bombing and SIM swaps. The key checks the website’s address, there is no prompt to approve and no phone number to steal.
- Number matchingStops blind taps on a flood of prompts: you have to type the number on the login screen into the app. Microsoft now applies it to every Authenticator push.
- Help-desk identity checksNo setting stops a convincing phone call. Stronger checks before any reset, fewer people allowed to reset MFA, and a clear route to escalate are what Bradley recommends in the long video.
- Malware already on the deviceEven a security key can’t help once malware is inside the browser. Mandiant says hardware keys protect only while the device itself isn’t compromised.
Check your own accounts
- If your phone shows a login prompt you didn’t start, deny it. Then change that account’s password, because someone already has it.
- Never type a password or code into a page you reached from a link in a text or email. Open the site yourself.
- In each important account’s security settings, look at the list of signed-in devices and sign out of any you don’t recognise.
- Add a passkey wherever the site offers one.
- Ask your mobile provider to put a PIN or password on your account.
If you think a session was stolen, change the password and sign out of every device. A new password alone may not end a session the attacker already has.
What we check after a suspected MFA bypass
In Microsoft 365, these are the first places we look when a user passed MFA and still ended up with someone else in their account.
- One session, two places
Microsoft found that a session stolen through a fake login page keeps the same session ID when the attacker reuses it. In the Entra ID sign-in logs, one session ID appearing from two countries or two unrelated IP addresses is the tell.
- Risk detections
Microsoft Entra ID Protection raises detections named Attacker in the Middle, Anomalous Token and Suspicious MFA authentication approval. Each needs a premium licence, so we first check which ones the company can see.
- New MFA methods and inbox rules
An attacker may register their own MFA method so they can come back, as CISA describes for Scattered Spider, or add an inbox rule to hide replies, as Microsoft saw in the AiTM campaign. We check both around the time of the sign-in.
- End the sessions as well
In Entra ID, under Users, each user’s Overview page has a Revoke sessions button that forces a fresh sign-in. Access tokens already handed out can keep working for up to an hour by default, so we reset the password and revoke sessions together.
What this doesn’t prove
Written from the public reports listed under Sources, checked 13 Nov 2026.
- These five routes cover the cases above. They aren’t a full list of ways round MFA.
- MGM Resorts’ 2023 breach is widely reported to have started with a call to its help desk, but MGM hasn’t said publicly how the attackers got in, so we haven’t used it as the example here.
- Each case is told as the company or agency reported it. We haven’t rerun these attacks ourselves.
- MFA still stops most attacks that only have a password. These cases show what gets past it, not a reason to switch it off. The MFA ranking note covers which methods hold up best.
Go deeper on our wiki
Sources
- From cookie theft to BEC: Attackers use AiTM phishing sites as entry point to further financial fraudMicrosoft Threat Intelligence, 12 Jul 2022
- BitM Up! Session Stealing in Seconds Using the Browser-in-the-Middle TechniqueMandiant, Google Cloud, 17 Mar 2025
- CircleCI Jan 4, 2023 security incident reportCircleCI, 13 Jan 2023
- Security updateUber, 16 Sep 2022, updated 19 Sep 2022
- U.K. citizen sentenced to five years for cybercrime offensesUS Department of Justice and IRS Criminal Investigation, 23 Jun 2023
- Form 8-K: cybersecurity incidentCaesars Entertainment, US SEC filing, 14 Sep 2023
- Scattered Spider (AA23-320A)CISA and FBI, 16 Nov 2023, revised 29 Jul 2025
- Implementing Phishing-Resistant MFA (fact sheet)CISA, Oct 2022
- Recommended types of MFANCSC, Reviewed 26 Sep 2024
- Number matching in MFA push notificationsMicrosoft Learn
- What are risk detections?Microsoft Learn
- Revoke user access in Microsoft Entra IDMicrosoft Learn
