7 min Reading Time<\/p>\n
59 percent of successfully compromised corporate accounts had multi-factor authentication (MFA) enabled. The reason: Adversary-in-the-Middle attacks (AiTM) and session token theft render the second factor ineffective. Microsoft reports 40,000 recognized AiTM incidents daily. SMS-based MFA is now considered insecure by the BSI (Federal Office for Information Security) and CISA. The solution is phishing-resistant authentication with FIDO2, passkeys, and hardware security keys.<\/strong><\/p>\n Adversary-in-the-Middle attacks function like an invisible proxy between the user and the authentication server. The attacker routes the login page in real-time through their server. The user enters their credentials and the MFA code, the attacker intercepts both and obtains the session token. From the server’s perspective, the login was legitimate.<\/p>\n Frameworks like EvilGinx2 and Modlishka have automated these attacks. An attacker no longer needs deep technical expertise. They purchase a phishing kit for a few hundred dollars, register a deceptively similar domain, and wait for victims. The stolen session tokens are immediately usable and often valid for hours or days.<\/p>\n Identity-based attacks<\/a> exploit this vector. According to Microsoft, token theft attacks were responsible for 31 percent of all breaches in Microsoft 365 environments in 2025. The trend is increasing as more companies enable MFA and attackers adapt.<\/p>\n \n“Token-Based Attacks completely bypass MFA because they do not attack the authentication but the session afterward. The attacker takes over an already authenticated session.” SMS as a second factor has three fundamental weaknesses. First: SIM swapping. An attacker convinces the mobile carrier to transfer the phone number to a new SIM card. Second: SS7 vulnerabilities. The signaling protocol of mobile networks allows SMS to be intercepted under certain conditions. Third: AiTM proxies intercept the SMS code in real-time before the user can enter it.<\/p>\n The BSI has recommended switching to phishing-resistant authentication methods since 2024. The CISA (U.S. counterpart to the BSI) also classifies SMS-MFA as “not phishing-resistant” and recommends FIDO2-based solutions.<\/p>\n FIDO2\/WebAuthn Security Keys<\/strong> (e.g., YubiKey, Google Titan): The safest option. The key is cryptographically bound to the domain. Even if a user falls for a phishing site, the key cannot authenticate for the wrong domain. Downside: Costs (starting at $25 per key) and logistics for large teams.<\/p>\n Passkeys<\/strong> (FIDO2 on the device): Smartphones or laptops replace the hardware key. Biometric authentication (fingerprint, Face ID) replaces the PIN. Domain binding like hardware keys. Advantage: No additional hardware. Downside: Dependence on the device manufacturer (Apple, Google, Microsoft).<\/p>\n Authenticator Apps with Number Matching<\/strong> (e.g., Microsoft Authenticator): Not complete phishing protection, but much better than SMS. Number Matching forces the user to enter a number from the screen into the app. AiTM attacks are made more difficult but not impossible.<\/p>\n Certificate-Based Authentication:<\/strong> Client certificates on managed devices. Very secure but complex to manage. Suitable for highly sensitive environments like KRITIS operators and authorities.<\/p>\n 1. Inventory:<\/strong> Which MFA methods are currently in use? How many users still use SMS or voice MFA? Microsoft Entra ID and Google Workspace offer reports on this.<\/p>\n 2. Define Pilot Group:<\/strong> IT admins and executives first. These accounts are the most valuable targets and should be migrated to FIDO2 or passkeys first.<\/p>\n 3. Configure Conditional Access:<\/strong> In Microsoft Entra ID<\/a>, conditional access policies can enforce phishing-resistant MFA for specific resources (Authentication Strength: Phishing-resistant MFA).<\/p>\n 4. Plan Fallback Options:<\/strong> What happens if a key is lost? Register at least two security keys per user. Configure temporary access passes (TAP) as an emergency option.<\/p>\n 5. Gradually Disable SMS-MFA:<\/strong> Do not disable it immediately, but lock it out for new registrations via policy and migrate existing users by deadline. Microsoft offers “Authentication Methods Migration” reports for this.<\/p>\n Every question is locked. A tap unlocks the answer.<\/p>\n Authenticator apps with number matching are much safer than SMS but not completely phishing-resistant. AiTM attacks can intercept the input in real-time. For high-risk accounts (admins, executives, access to sensitive data), the BSI and CISA recommend FIDO2-based solutions.<\/p>\n<\/details>\n Hardware keys like YubiKey cost from $25 each. For a 100-person company with two keys per user (primary and backup key), the cost is around $5,000. Setup is natively supported in Microsoft Entra ID and Google Workspace and does not require additional infrastructure.<\/p>\n<\/details>\n For most companies, yes. Passkeys offer the same cryptographic security as FIDO2 keys but use the existing device (smartphone, laptop) instead of separate hardware. The trade-off: Passkeys are tied to the device and its ecosystem (Apple, Google, Microsoft). In case of device loss, a recovery process must be in place.<\/p>\n<\/details>\n Conditional Access is a policy framework in Microsoft Entra ID (and similar systems) that enforces context-dependent access rules. A company can specify: Admins must use FIDO2, external access requires a managed device, token sessions are terminated after 4 hours. Without conditional access, MFA remains a checkbox rather than a strategy.<\/p>\n<\/details>\n Microsoft Entra ID shows suspicious sign-ins under “Risky Sign-Ins” with the risk details type “Anomalous Token.” Additionally, impossible travel alerts (login from two countries within an impossible timeframe) and session token usage from unknown IP addresses help.<\/p>\n<\/details>\n More from the MBF Media Network<\/p>\n Header Image Source: Pexels \/ Sora Shimazaki<\/p>\n","protected":false},"excerpt":{"rendered":"59 percent of successfully compromised corporate accounts had multi-factor authentication (MFA) enabled. The reason: Adversary-in-the-Middle attacks (AiTM) and session token theft render the second factor ineffective. Microsoft reports 40,000 recognized AiTM incidents daily. SMS-based MFA is now considered insecure by the BSI (Federal Office for Information Security) and CISA. The solution […]","protected":false},"author":55,"featured_media":5451,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_yoast_wpseo_focuskw":"mfa-bypass","_yoast_wpseo_title":"MFA-Bypass 2026: Why Your Second Factor No Longer Protects You","_yoast_wpseo_metadesc":"MFA-Bypass 2026: Why your second factor fails against AiTM attacks\u2014learn how to truly secure accounts. Read the shocking truth and act now.","_yoast_wpseo_meta-robots-noindex":"","_yoast_wpseo_meta-robots-nofollow":"","_yoast_wpseo_meta-robots-adv":"","_yoast_wpseo_canonical":"","_yoast_wpseo_opengraph-title":"","_yoast_wpseo_opengraph-description":"","_yoast_wpseo_opengraph-image":"","_yoast_wpseo_opengraph-image-id":0,"_yoast_wpseo_twitter-title":"","_yoast_wpseo_twitter-description":"","_yoast_wpseo_twitter-image":"","_yoast_wpseo_twitter-image-id":0,"evm_kih_original":false,"_evm_slot_owner":"","evm_cvss":0,"evm_risk":0,"evm_casefile":"","evm_primary_cve":"","evm_pin_until":0,"evm_external_preview_token":"","evm_external_preview_expires":"","_evm_translation_lang":"","featured_post":0,"featured_post_sortierung":0,"_wp_old_slug":["post_id-5453"],"footnotes":""},"categories":[255],"tags":[],"class_list":["post-7622","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-praxis-umsetzung-en"],"evm_reading_time_minutes":6,"wpml_language":"en","wpml_translation_of":5453,"_links":{"self":[{"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/posts\/7622","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/users\/55"}],"replies":[{"embeddable":true,"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/comments?post=7622"}],"version-history":[{"count":5,"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/posts\/7622\/revisions"}],"predecessor-version":[{"id":19763,"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/posts\/7622\/revisions\/19763"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/media\/5451"}],"wp:attachment":[{"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/media?parent=7622"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/categories?post=7622"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/tags?post=7622"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}TL;DR<\/h2>\n
\n
How AiTM Attacks Bypass MFA<\/h2>\n
\nObsidian Security, Token-Based Attack Research 2025<\/cite>\n<\/p><\/blockquote>\nWhy SMS-MFA Is No Longer Sufficient<\/h2>\n
Comparing Phishing-Resistant Alternatives<\/h2>\n
Practical Checklist: Implementing Phishing-Resistant MFA<\/h2>\n
Frequently Asked Questions<\/h2>\n
Is an authenticator app sufficient for MFA?<\/strong><\/summary>\n
How much does switching to FIDO2 security keys cost?<\/strong><\/summary>\n
Can passkeys replace hardware keys?<\/strong><\/summary>\n
What is conditional access and why is it crucial for MFA security?<\/strong><\/summary>\n
How do I detect AiTM attacks on my company?<\/strong><\/summary>\n
Editorial Recommendations<\/h2>\n
\n