{"id":7509,"date":"2023-10-05T09:00:00","date_gmt":"2023-10-05T09:00:00","guid":{"rendered":"https:\/\/www.securitytoday.de\/2026\/04\/02\/post_id-5053\/"},"modified":"2026-07-04T12:24:57","modified_gmt":"2026-07-04T12:24:57","slug":"how-attackers-bypass-mfa-adversary-in-the-middle-mfa-fatigue-and-token-theft","status":"publish","type":"post","link":"https:\/\/www.securitytoday.de\/en\/2023\/10\/05\/how-attackers-bypass-mfa-adversary-in-the-middle-mfa-fatigue-and-token-theft\/","title":{"rendered":"How Attackers Bypass MFA: Adversary-in-the-Middle, MFA-Fatigue, and Token Theft"},"content":{"rendered":"<p><strong>Multi-Factor Authentication (MFA) was long considered the silver bullet against account compromise. But attackers have caught up: Adversary-in-the-Middle proxies intercept MFA tokens in real-time, MFA-fatigue attacks harass users until they give in, and session token theft makes the second factor irrelevant. MFA remains important  &#8211;  but it&#8217;s no longer enough on its own.<\/strong><\/p>\n<h2>TL;DR<\/h2>\n<ul>\n<li>AiTM proxies (Evilginx, Modlishka) intercept MFA tokens in real-time<\/li>\n<li>MFA-fatigue: The Uber hack of 2022 succeeded through push-bombing<\/li>\n<li>Session token theft via infostealers bypasses MFA entirely<\/li>\n<li>FIDO2\/Passkeys are the only phishing-resistant standard<\/li>\n<\/ul>\n<h2>Adversary-in-the-Middle: The Invisible Proxy<\/h2>\n<p>AiTM attacks insert a reverse proxy between the user and the legitimate login page. The user sees a perfect copy, enters credentials and MFA code  &#8211;  the proxy forwards everything and intercepts the resulting session token. The attacker now has an authenticated session without ever possessing the second factor.<\/p>\n<p>Tools like Evilginx2 make such attacks alarmingly simple. A convincing phishing domain, a configured proxy, and MFA is circumvented. Microsoft reported in 2023 that over 10,000 organizations were affected by AiTM campaigns.<\/p>\n<h2>MFA-Fatigue: The Human Factor<\/h2>\n<p>In the Uber hack of 2022, the attacker bombarded an employee with MFA push notifications  &#8211;  hundreds in a short period. Eventually, the victim tapped &#8220;Approve&#8221; to stop the barrage. Once was enough.<\/p>\n<p>MFA-fatigue works because push-based MFA only asks the user &#8220;Was that you?&#8221;  &#8211;  without context. Countermeasures: Number Matching (the user must enter a number from the login page into the app), rate limiting, and anomaly-based alerts for unusual MFA activity.<\/p>\n<h2>Session Token Theft: Bypassing MFA Without Targeting It<\/h2>\n<p>Infostealer malware (Raccoon, Redline, Vidar) steals browser cookies and session tokens directly from the device. With a valid session token, the attacker can take over the session  &#8211;  MFA was already passed during login and is no longer relevant.<\/p>\n<p>The result: Authenticated sessions are traded on dark web marketplaces. A valid session token for a corporate M365 account costs less than 10 USD. The solution: Token Binding, Conditional Access with Device Compliance, and regular session invalidation.<\/p>\n<h2>The Solution: FIDO2 and Phishing-Resistant MFA<\/h2>\n<p>FIDO2-based authentication (hardware keys, passkeys) is inherently immune to AiTM attacks: The private key is bound to the domain. A proxy on another domain gets no valid signature. Push-bombing is also excluded  &#8211;  the user must physically touch a key or biometrically confirm.<\/p>\n<p>Google reports: Since the FIDO2 mandate for all employees (2017), there have been zero successful phishing attacks on employee accounts. The technology works  &#8211;  the challenge is adoption in the enterprise context.<\/p>\n<h2>Key Facts<\/h2>\n<p><strong>AiTM Campaigns:<\/strong> Over 10,000 affected organizations in 2023 (Microsoft)<\/p>\n<p><strong>Session Token Price:<\/strong> Less than 10 USD on dark web marketplaces<\/p>\n<p><strong>FIDO2 at Google:<\/strong> 0 successful phishing attacks since introduction in 2017<\/p>\n<h2>Frequently Asked Questions<\/h2>\n<p class=\"st-faq-hint\">Every question is locked. A tap unlocks the answer.<\/p>\n<details>\n<summary><strong>Should I disable MFA if it can be bypassed?<\/strong><\/summary>\n<p style=\"margin:8px 0 4px 24px;color:#555;line-height:1.6;\">Absolutely not. MFA still blocks over 99 percent of automated credential attacks. The mentioned bypass techniques require targeted effort. MFA remains mandatory  &#8211;  but should be supplemented with phishing-resistant methods (FIDO2).<\/p>\n<\/details>\n<details>\n<summary><strong>What is Number Matching in MFA?<\/strong><\/summary>\n<p style=\"margin:8px 0 4px 24px;color:#555;line-height:1.6;\">Instead of just &#8220;Approve\/Reject,&#8221; the login page displays a two-digit number. The user must enter the same number in the authenticator app. This prevents blind approval in MFA-fatigue attacks. Microsoft and Duo offer Number Matching natively.<\/p>\n<\/details>\n<details>\n<summary><strong>Does a VPN protect against AiTM attacks?<\/strong><\/summary>\n<p style=\"margin:8px 0 4px 24px;color:#555;line-height:1.6;\">No. AiTM attacks target cloud services (M365, Google Workspace) used directly via the browser  &#8211;  not via VPN. Protection lies in phishing-resistant authentication and Conditional Access policies that check device compliance.<\/p>\n<\/details>\n<h2>Related Articles<\/h2>\n<ul>\n<li><a href=\"https:\/\/www.securitytoday.de\/en\/2026\/03\/06\/post_id-3837\/\">Cybersecurity Trends 2026: The 7 Developments Security Decision-Makers Need to Know<\/a><\/li>\n<li><a href=\"https:\/\/www.securitytoday.de\/en\/2026\/02\/20\/post_id-3525\/\">Recognizing AI-Generated Phishing Emails: 7 Warning Signs for 2026<\/a><\/li>\n<li><a href=\"https:\/\/www.securitytoday.de\/en\/2026\/02\/20\/post_id-3839\/\">Cybersecurity 2030: Five Predictions for the Next Decade of IT Security<\/a><\/li>\n<\/ul>\n<p style=\"font-weight:700;color:#e6e3da;font-size:1.05em;margin:48px 0 16px;\">More from the MBF Media Network<\/p>\n<div style=\"display:flex;flex-direction:column;gap:14px;margin-bottom:40px;\"><a href=\"https:\/\/www.cloudmagazin.com\" class=\"st-net-card\" style=\"display:block;padding:16px 18px;background:#23261f;border:1px solid rgba(105,216,237,0.22);border-radius:10px;box-shadow:inset 0 1px 0 rgba(230,227,218,0.06),0 2px 10px rgba(0,0,0,0.22);text-decoration:none;color:#e6e3da;\"><span style=\"display:block;margin-bottom:6px;font-size:0.72em;font-weight:700;letter-spacing:0.06em;text-transform:uppercase;color:#0bb7fd;\">cloudmagazin<\/span><span style=\"display:block;color:#e6e3da;line-height:1.45;\">Cloud Magazine<\/span><\/a><a href=\"https:\/\/www.mybusinessfuture.com\" class=\"st-net-card\" style=\"display:block;padding:16px 18px;background:#23261f;border:1px solid rgba(105,216,237,0.22);border-radius:10px;box-shadow:inset 0 1px 0 rgba(230,227,218,0.06),0 2px 10px rgba(0,0,0,0.22);text-decoration:none;color:#e6e3da;\"><span style=\"display:block;margin-bottom:6px;font-size:0.72em;font-weight:700;letter-spacing:0.06em;text-transform:uppercase;color:#aa8ac2;\">MyBusinessFuture<\/span><span style=\"display:block;color:#e6e3da;line-height:1.45;\">My Business Future<\/span><\/a><a href=\"https:\/\/www.digital-chiefs.de\" class=\"st-net-card\" style=\"display:block;padding:16px 18px;background:#23261f;border:1px solid rgba(105,216,237,0.22);border-radius:10px;box-shadow:inset 0 1px 0 rgba(230,227,218,0.06),0 2px 10px rgba(0,0,0,0.22);text-decoration:none;color:#e6e3da;\"><span style=\"display:block;margin-bottom:6px;font-size:0.72em;font-weight:700;letter-spacing:0.06em;text-transform:uppercase;color:#d65663;\">Digital Chiefs<\/span><span style=\"display:block;color:#e6e3da;line-height:1.45;\">Digital Chiefs<\/span><\/a><\/div>\n","protected":false},"excerpt":{"rendered":"Multi-Factor Authentication (MFA) was long considered the silver bullet against account compromise. But attackers have caught up: Adversary-in-the-Middle proxies intercept MFA tokens in real-time, MFA-fatigue attacks harass users until they give in, and session token theft makes the second factor irrelevant. MFA remains important &#8211; but it&#8217;s no longer enough on its own. TL;DR AiTM [&hellip;]","protected":false},"author":55,"featured_media":5052,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_yoast_wpseo_focuskw":"mfa","_yoast_wpseo_title":"How Attackers Bypass MFA: Adversary-in-the-Middle, MFA-Fatigue, and Token Theft","_yoast_wpseo_metadesc":"MFA bypass attacks: Learn how Adversary-in-the-Middle, MFA-fatigue, and token theft compromise security. Discover defenses and protect your accounts now.","_yoast_wpseo_meta-robots-noindex":"","_yoast_wpseo_meta-robots-nofollow":"","_yoast_wpseo_meta-robots-adv":"","_yoast_wpseo_canonical":"","_yoast_wpseo_opengraph-title":"","_yoast_wpseo_opengraph-description":"","_yoast_wpseo_opengraph-image":"","_yoast_wpseo_opengraph-image-id":0,"_yoast_wpseo_twitter-title":"","_yoast_wpseo_twitter-description":"","_yoast_wpseo_twitter-image":"","_yoast_wpseo_twitter-image-id":0,"evm_kih_original":false,"_evm_slot_owner":"","evm_cvss":0,"evm_risk":0,"evm_casefile":"","evm_primary_cve":"","evm_pin_until":0,"evm_external_preview_token":"","evm_external_preview_expires":"","_evm_translation_lang":"","featured_post":0,"featured_post_sortierung":0,"_wp_old_slug":["post_id-5053"],"footnotes":""},"categories":[255],"tags":[236,239],"class_list":["post-7509","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-praxis-umsetzung-en","tag-phishing","tag-zero-trust"],"evm_reading_time_minutes":4,"wpml_language":"en","wpml_translation_of":5053,"_links":{"self":[{"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/posts\/7509","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/users\/55"}],"replies":[{"embeddable":true,"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/comments?post=7509"}],"version-history":[{"count":5,"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/posts\/7509\/revisions"}],"predecessor-version":[{"id":19821,"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/posts\/7509\/revisions\/19821"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/media\/5052"}],"wp:attachment":[{"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/media?parent=7509"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/categories?post=7509"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/tags?post=7509"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}