Explains why MFA bypass attacks are increasing and the shift to phishing-resistant authentication methods.
The false sense of security
Your users probably think they are safe because they check the 'use MFA' box. They are wrong.
The numbers are brutal: 99% of organizations faced account takeover attempts last year. 67% had at least one successful breach. And here's the kicker: 83% of those attacks bypassed the very MFA you thought was protecting you.
Traditional MFA isn't just failing to stop attacks — it's giving organizations a false sense of security.
How attackers bypass MFA
Attackers are not just guessing passwords anymore. They're using sophisticated techniques like push bombing, where they spam users with MFA requests until one gets clicked by accident.
They're running AiTM (Adversary-in-the-Middle) attacks that capture authentication sessions in real-time. Token theft attacks compromise the session cookies that MFA was supposed to protect.
We saw this in major breaches last year. Change Healthcare's ransomware attack, Snowflake's customer data theft - all exploited MFA weaknesses.
The fundamental problem
Most MFA methods rely on something the user knows or has, but not something the user is.
- A one-time code sent to your phone? Still phishable.
- A hardware token? Still vulnerable to session hijacking.
- Even biometric authentication can be bypassed with sophisticated spoofing.
MFA alone will not save you. But the right kind of authentication can actually stop attackers, not just slow them down.
The solution: Phishing-resistant authentication
This is why phishing-resistant authentication has moved from nice-to-have to must-have. FIDO2 and passkeys use public-key cryptography that binds authentication to the specific domain you're logging into.
An attacker cannot intercept these credentials because they're cryptographically useless outside the legitimate service. Apple and Google have implemented this in their ecosystems, making it accessible without buying expensive hardware.
What you need to do today
- Get rid of SMS-based authentication - it's the weakest link
- Implement number matching for push notifications so users cannot be tricked by fake approval requests
- Start planning your move to FIDO2-based authentication, starting with privileged accounts and remote access users
Microsoft now requires this for administrator roles, and they're right to do so. Start with privileged accounts and remote access users, then expand from there.
