How Hackers Bypass MFA — and What Businesses Can Do About It

For years, businesses have been told: 

Turn on Multi-Factor Authentication. 

That is still excellent advice. 

MFA can prevent many account compromises by requiring something more than a username and password. 

But there is an important distinction that business owners should understand: 

Having MFA does not mean every type of account takeover becomes impossible. 

Attackers have adapted. 

Instead of simply stealing a password and trying to log in, some attacks are designed to trick the employee into completing the MFA process for them or to steal the authenticated session after the employee successfully signs in. 

Microsoft has documented adversary-in-the-middle phishing campaigns capable of intercepting authentication traffic and capturing tokens that can provide immediate account access, even when non-phishing-resistant MFA is being used.  

That does not mean businesses should stop using MFA. 

It means businesses should understand that not all MFA is equal.

Why MFA Is Still One of the Most Important Security Controls 

Passwords are frequently stolen through: 

• Phishing  

• Malware  

• Credential-stealing software  

• Data breaches  

• Password reuse  

• Fake login pages  

• Social engineering  

If a business relies only on passwords, a stolen password may be all an attacker needs. 

MFA adds another requirement. 

Depending on the configuration, that might include: 

• An authenticator app  

• A push notification  

• A one-time code  

• A text message  

• A security key  

• Windows Hello  

• A passkey  

• Biometric authentication  

This additional step blocks many ordinary credential attacks. 

The problem is that attackers increasingly design phishing specifically around the authentication process. 

MFA Does Not Mean Every Authentication Method Is Equally Strong 

Consider two employees. 

Employee A enters a password and then receives a six-digit code. 

Employee B uses a passkey tied to the legitimate website. 

Both may technically be using multi-factor authentication. 

But the resistance to phishing can be very different. 

Microsoft describes passkeys as phishing-resistant because the passkey is associated with the legitimate website or application. If the employee lands on a convincing fake site, the device will not present that passkey to the malicious site.  

That ability to recognize the legitimate destination is extremely important.

Method 1: Fake Microsoft 365 Login Pages 

One of the most common attacks begins with a phishing message. 

The employee receives something that appears to be: 

• A Microsoft security alert  

• A shared document  

• A password-expiration notice  

• An encrypted message  

• A voicemail  

• An HR document  

• A QR-code verification request  

The employee follows the link. 

The website looks like Microsoft 365. 

They enter their email address. 

Then their password. 

If the fake website simply steals the password, MFA may still prevent the attacker from logging in. 

So more advanced phishing attacks go further. 

Method 2: Adversary-in-the-Middle Phishing 

Adversary-in-the-middle phishing, often abbreviated AiTM, is more sophisticated than an ordinary fake login page. 

The attacker places infrastructure between the employee and the legitimate authentication service. 

The employee believes they are logging into Microsoft normally. 

They may actually complete the real authentication process. 

The attacker proxies that process and attempts to capture the authenticated session or token. 

Microsoft documented a 2026 phishing campaign where victims were led through an AiTM flow that could capture authentication tokens and provide attackers with immediate account access.  

This is why the security industry increasingly distinguishes between ordinary MFA and phishing-resistant MFA.

Method 3: MFA Fatigue or Push Bombing 

Another attack is much simpler. 

The criminal already has the employee's password. 

They try to sign in repeatedly. 

The employee starts receiving authentication requests: 

Approve? 

Approve? 

Approve? 

Eventually the employee may think: 

“Maybe Microsoft needs me to approve this.” 

And tap yes. 

This is sometimes called MFA fatigue, push bombing, or MFA prompt bombing. 

It relies on frustration and confusion instead of advanced technology. 

The lesson for employees should be extremely clear: 

Never approve an MFA request you did not initiate. 

Unexpected authentication prompts should be reported to IT. 

Method 4: Stealing the MFA Code 

One-time codes are better than relying on a password alone. 

But a code can sometimes be phished. 

An attacker may create a website that asks: 

Enter your password. 

Then: 

Enter the verification code we just sent you. 

The victim enters the code. 

The attacker immediately uses it during the real login process. 

The user technically had MFA. 

The attacker simply convinced the user to provide both factors. 

This is one reason phishing-resistant authentication is increasingly important.

Method 5: QR Code Phishing 

QR-code phishing adds another variation. 

The employee receives an email telling them to scan a code to: 

• Re-register MFA  

• Verify a Microsoft 365 account  

• Prevent an account from being disabled  

• Review a secure document  

The employee scans it using a phone. 

They arrive at a fake authentication page and enter credentials or approve authentication. 

The attack is particularly effective because the employee may be moved away from the managed computer and onto a personal mobile device. 

Method 6: Social Engineering the Help Desk 

Technology is not always the weakest point. 

Sometimes the attacker contacts the help desk. 

They may pretend to be: 

• An employee who lost a phone  

• An executive traveling overseas  

• A new employee unable to log in  

• Someone who needs MFA reset urgently  

If support personnel reset authentication without properly verifying the person's identity, the attacker may gain access. 

Businesses should have clear procedures for identity verification before MFA methods or passwords are reset. 

Method 7: Account Recovery Becomes the Weakest Link 

Strong authentication does not help much if the account recovery process is weak. 

Imagine requiring a strong passkey for normal login but allowing an attacker to reset everything with easily guessed information or weak verification. 

Security has to cover the entire account lifecycle: 

• Enrollment  

• Normal authentication  

• Password resets  

• MFA resets  

• Lost devices  

• Employee onboarding  

• Employee offboarding  

• Account recovery  

Microsoft has been moving toward stronger authentication and away from weaker recovery and authentication methods as part of this broader effort. 

Method 8: A Trusted Device Is Already Compromised 

MFA primarily protects authentication. 

It cannot solve every security problem. 

If malware is already running on the employee's computer, attackers may attempt to steal information from the active session, browser, or device. 

That is why identity security should be supported by: 

• Endpoint protection  

• Device management  

• Patch management  

• Web filtering  

• Security monitoring  

• Least-privilege access  

MFA is a layer. 

It should not be the only layer.

What Is Phishing-Resistant MFA? 

Phishing-resistant authentication is designed so that an employee cannot easily hand the authentication credential to a fake website. 

Passkeys are an important example. 

Microsoft explains that passkeys are associated with the specific site or application for which they were created. A passkey intended for the legitimate site cannot simply be presented to an attacker-controlled lookalike website.  

Examples of stronger authentication approaches may include: 

• Passkeys  

• FIDO2 security keys  

• Windows Hello for Business  

• Other properly configured certificate or hardware-backed authentication methods  

Microsoft itself has moved toward phishing-resistant MFA as part of its Secure Future Initiative. 

What Are Passkeys? 

A passkey replaces the traditional password-based sign-in with cryptographic authentication associated with a device or account. 

Instead of typing a password, the employee may confirm identity using: 

• Face recognition  

• Fingerprint  

• Device PIN  

• Security key  

The important difference is what happens behind the scenes. 

The private authentication credential is not typed into the website. 

It stays protected on the user's device or approved credential provider. 

Microsoft says passkeys provide phishing resistance because they are tied to the legitimate domain.  

Does This Mean Businesses Should Get Rid of MFA Codes Tomorrow? 

No. 

Authentication changes should be planned. 

Businesses have different: 

• Applications  

• Devices  

• Employees  

• Legacy systems  

• Remote-work requirements  

• Shared-workstation environments  

The goal should be to gradually strengthen authentication, beginning with the accounts that create the greatest risk. 

Start With Your Highest-Risk Accounts 

Not every account creates the same potential damage. 

Businesses should consider prioritizing stronger authentication for: 

• Global administrators  

• IT administrators  

• Owners and executives  

• Accounting employees  

• Payroll employees  

• Employees authorized to move money  

• HR  

• Employees with access to sensitive customer information  

An attacker who compromises an administrator or finance employee can potentially create far more damage than someone with limited access. 

Conditional Access Can Add Another Layer 

Microsoft 365 environments can use Conditional Access policies to make authentication decisions based on additional context. 

Depending on licensing and configuration, policies may consider factors such as: 

• User  

• Device  

• Location  

• Application  

• Risk level  

• Authentication method  

Conditional Access can then require additional security or block access entirely. 

Microsoft uses Conditional Access alongside phishing-resistant authentication as part of its own security strategy.  

The important point is that identity security can evaluate more than just: 

“Did this person enter the correct password?” 

Review Administrator Accounts 

Administrator accounts deserve additional protection. 

Businesses should review: 

• How many Global Administrators exist  

• Whether administrators use separate privileged accounts  

• Whether strong authentication is enforced  

• Whether former vendors retain administrator access  

• Whether old accounts still exist  

• Whether privileges are greater than necessary  

The fewer accounts capable of making major changes, the smaller the potential attack surface. 

Review Third-Party Applications Too 

Attackers may also attempt to gain access through applications connected to Microsoft 365. 

Businesses should periodically review: 

• Enterprise applications  

• OAuth permissions  

• Third-party integrations  

• Employee-consented applications  

• Old applications nobody uses anymore  

Microsoft continues to report phishing activity involving legitimate OAuth mechanisms and malicious redirection techniques, reinforcing the importance of reviewing connected applications as part of identity security.  

Train Employees Differently 

Traditional training says: 

Don't give anyone your password. 

That is no longer enough. 

Employees should also understand: 

• Do not approve unexpected MFA prompts  

• Do not enter verification codes into suspicious websites  

• Be cautious of Microsoft login pages reached through email  

• Be cautious of QR codes asking for authentication  

• Contact IT when authentication behaves strangely  

• Never let someone pressure them into bypassing security procedures  

One of the most important lessons is: 

MFA prompts should make sense. 

If you are sitting at lunch and suddenly receive a Microsoft authentication request, somebody may be trying to log into your account. 

What Should You Do If You Approve an MFA Request by Mistake? 

Contact IT immediately. 

Do not assume: 

“Well, nothing happened.” 

The IT or security team may need to: 

• Reset credentials  

• Revoke active sessions  

• Review sign-in logs  

• Check authentication methods  

• Look for unfamiliar devices  

• Review mailbox forwarding  

• Check inbox rules  

• Review application permissions  

• Look for suspicious messages  

• Examine administrator changes  

Speed matters. 

If the employee reports the mistake quickly, the security team has a better opportunity to contain the problem. 

 A Simple MFA Security Checklist for Small Businesses 

Businesses should consider: 

• Require MFA for all employees  

• Protect administrator accounts more strongly  

• Move toward phishing-resistant authentication where practical  

• Consider passkeys for high-risk accounts  

• Review Conditional Access  

• Remove unused administrator accounts  

• Review former employee access  

• Review vendor accounts  

• Review connected applications  

• Train employees about unexpected MFA prompts  

• Monitor unusual sign-ins  

• Protect endpoints  

• Create strong MFA-reset procedures  

• Have a clear incident-response process  

How Network Computer Pros Helps Businesses Strengthen Microsoft 365 Authentication 

Network Computer Pros helps small and mid-sized businesses review identity and Microsoft 365 security as part of a broader cybersecurity strategy. 

That can include reviewing: 

• Multi-Factor Authentication  

• Microsoft Entra ID  

• Conditional Access  

• Administrator accounts  

• Authentication methods  

• Microsoft 365 security settings  

• User access  

• Former employee accounts  

• Third-party applications  

• Employee cybersecurity training  

• Account-recovery processes  

The objective is not simply to check a box that says: 

“MFA enabled.” 

The better question is: 

Is the authentication strategy appropriate for the risks facing the business today? 

We support businesses throughout South Florida and Middle Tennessee, including Davie, Fort Lauderdale, Miami, Boca Raton, Nashville, Franklin, Brentwood, and surrounding communities.

Frequently Asked Questions About MFA Security

MFA Should Be the Beginning of Your Identity Security Strategy — Not the End 

Turning on Multi-Factor Authentication is one of the best improvements a business can make. 

But cybersecurity keeps changing. 

Attackers now design phishing specifically to exploit authentication workflows, steal sessions, and manipulate employees. 

That means the conversation needs to evolve from: 

“Do we have MFA?” 

to: 

“Are we using the strongest practical authentication for the accounts that matter most?” 

Start with MFA. 

Then look at passkeys, phishing resistance, Conditional Access, administrator access, connected applications, employee training, and account recovery. 

Those layers work together. 

Network Computer Pros can help review your Microsoft 365 authentication, user access, and cybersecurity controls to identify areas where stronger protection may make sense. 

Schedule a quick cybersecurity consultation to review your Microsoft 365 identity security.