Of note is that fact that attackers have found weaknesses across all aspects of enterprise computing infrastructure. Part of the problem is that the average modern authentication workflow is complex: Users can arrive at an application via a web portal, a smartphone app, an AI query, or an API. They can connect via a variety of endpoints, through a local network or a VPN, running different OSes and browsers. As a result, any enterprise testing its MFA portfolio must apply careful and continual vigilance to a grab bag of circumstances and locations where MFA codes can be intercepted.
MFA bypass and exploit technologies
| Methods | Network | Mobile | Applications | Workflow | Browser and cookie |
| Fatigue | Gaps in auth and access policies | Prompt bombing, Gaps in auth and access policies | Prompt bombing | Prompt bombing, Gaps in auth and access policies | Prompt bombing, Gaps in auth and access policies |
| Social Engineering | Evil proxy servers, Real-time phishing relay | Vishing, SMS phishing, SIM swapping | Non MFA-enabled apps, Faked websites, TOTP relay | Consent phishing, Account recovery abuses | Man-in-the-browser, Consent phishing |
| Stealing auth tokens/cookies | MITM attacks | Auth app phising | Malicious MFA software | Session hijacking | Session hijacking, Pass-the-cookie |
| Targeting weak authentication | Manipulate trusted IPs/devices | Reused passwords, Lack of FIDO/biometrics | Weak account recovery, Non-MFA accounts, IMAP/POP email access | Prior auth/logins, Brute force MFA | Session hijacking, Pass-the-cookie, Man-in-the-browser, Consent phishing |
MFA fatigue
MFA fatigue is an attack modality that involves rapidly sending numerous authorization requests, typically via SMS push messages, until a user gives in and approves the request, granting access to an attacker, such as what happened toUber in 2022.