Originally published at ewright3.com

In January 2024, the SEC's official X account was hijacked. Attackers posted a fake Bitcoin ETF approval announcement, briefly moving markets. The Securities and Exchange Commission, the agency that writes the rules on public company cybersecurity disclosures, couldn't protect its own phone number. The compromise mechanism was a SIM swap. No sophisticated exploit. No zero-day. Just a phone call to a carrier.

The SEC account had MFA (multi-factor authentication) disabled for several months before the attack. The SIM swap gave the attacker control of the phone number tied to account recovery, and that was enough.

This is the part of the MFA conversation most security guides skip. Enabling MFA is the right call. Full stop. But the SEC's failure illustrates two problems at once: MFA only works when it's on, and even when it is on, the recovery path around it is often the weakest link.

The Stat That's True and Misleading

You've probably seen the Microsoft figure: MFA blocks 99.9% of automated account attacks. That number is real. It comes from Microsoft's own telemetry across hundreds of millions of accounts, and it holds up. Enable MFA and you will stop the overwhelming majority of credential-stuffing bots, password spray campaigns, and bulk phishing attempts cold.

The problem is what that 99.9% actually measures. It counts automated, untargeted attacks: scripts running against millions of accounts at once, hoping some percentage of stolen passwords still work. Against that threat, MFA is nearly a complete solution.

It measures almost nothing about a motivated attacker who has decided to target you specifically.

How Attackers Actually Bypass MFA Today

The modern playbook has three primary moves, and none involve "breaking" MFA cryptographically. They work around it.

Session theft via AiTM (adversary-in-the-middle) phishing. Tools like Evilginx and commercial phishing kits like Tycoon 2FA (sold on Telegram for around $120 a month) operate as reverse proxies between you and the real login page. You visit what looks like your Microsoft 365 or Google login. You enter your credentials. You complete MFA. The proxy captures the authenticated session token the server hands back to your browser. The attacker replays that token from their own machine. Your MFA process completed successfully. It just completed for both of you.

This technique was used in a 2023 campaign documented by Proofpoint that targeted C-suite executives with roughly 120,000 phishing emails and bypassed MFA at hundreds of organizations. The session token was the target. Not the password, not the OTP (one-time passcode).

SIM swapping. Your SMS-based OTP goes to your phone number, not your phone. Those are different things. An attacker who convinces your mobile carrier to transfer your number to a SIM they control receives every text you'd receive. It happens regularly enough that the FCC fined T-Mobile $31.5 million in 2024 specifically for enabling it. Scattered Spider, the group responsible for the MGM Resorts breach in September 2023, used SIM swapping as part of their access chain. MGM's estimated losses: over $100 million. They had MFA deployed.

MFA fatigue. If an attacker has your credentials, they trigger push notification requests to your authenticator app repeatedly: sometimes for an hour straight, sometimes at 3 AM. When that fails, they call you, claim to be IT support, and ask you to approve. In September 2022, an Uber contractor approved a push after exactly this sequence. Full internal network access followed. In Cisco's case the same year, the attacker verbally walked the employee through approving the push after fatigue alone didn't work.

Number matching, where you enter a code from your login screen into the app, raises the bar. Microsoft made it mandatory in their Authenticator app in May 2023. It helps. Social engineering can still work around it.

The AI Accelerant

None of the above techniques are new. What's changed is the cost of executing them.

In February 2024, a finance employee at a multinational company joined a video call with his CFO and several colleagues to discuss a wire transfer. He transferred HK$200 million, roughly $25.6 million USD. Every person on that call except him was an AI-generated deepfake. Hong Kong police confirmed the case. The "multi-factor verification" the company relied on for large transfers was an out-of-band video call. The attackers built a fake one.

Ferrari had a near-miss the same year. An executive received a call with a convincing voice clone of CEO Benedetto Vigna. The executive caught it by asking a personal question the caller couldn't answer.

The implication isn't that AI can crack cryptographic tokens. It can't. The implication is that the social engineering layer, the part that convinces you to approve a push or authorize a wire transfer, just got dramatically cheaper to run at scale. IBM's X-Force 2024 Threat Intelligence Index noted a measurable increase in high-quality phishing volume tied directly to LLM (large language model) availability. The grammar and context that used to flag phishing as obvious fakes are no longer reliable signals.

The Token Is the New Password

AiTM phishing, SIM swapping, and push fatigue all share the same logic: don't break the lock, steal the key after the door is already open. That key is the session token, and it has become the primary target in every major breach of the last two years.

The Okta breach in October 2023 is worth sitting with. Okta is one of the largest enterprise identity and MFA providers in the world. An attacker stole session tokens from a support engineer's laptop via infostealer malware (software that silently harvests credentials and session data from a device). The MFA vendor got bypassed by token theft.

Not ironic. Illustrative. The Snowflake breach in mid-2024 followed the same pattern at larger scale: infostealer malware harvested credentials and session tokens, and 165 customer tenants were accessed. Ticketmaster and Santander were among them. SpyCloud's 2024 Identity Exposure Report found 43.7 billion distinct identity assets in criminal markets from 2023 alone, with 61% of analyzed breaches tied directly to infostealer malware. In the Snowflake case, many stolen credentials had been valid and unchanged for months after the initial infection. Shorter token lifetimes and forced re-authentication would have limited the blast radius significantly.

The authentication event, the moment MFA actually runs, is no longer the primary target. Attackers want the session token it produces, because that token is what the application trusts for the next several hours. Your password and OTP are the door. The session token is the key that's already inside.

Shortening token lifetimes, enforcing Conditional Access policies that evaluate device health continuously, and covering endpoints with EDR (endpoint detection and response) that catches infostealer malware before it exfiltrates your browser's cookie store: these are the controls that address the actual attack surface.

The Upgrade Path

MFA is still worth enabling everywhere. The 99.9% figure means something real: no automated bulk attack will find you a viable target. That alone puts you ahead of most accounts on the internet.

The question is whether you're protected against a motivated attacker. For that, the hierarchy is:

1. SMS or email OTP: better than nothing, vulnerable to SIM swap and real-time relay. Avoid as primary MFA for high-value accounts (email, banking, work SSO).
2. TOTP, or time-based one-time passcode (authenticator app): significantly better. Still vulnerable to AiTM phishing if an attacker is proxying your login in real time.
3. Push notification with number matching: solid for enterprise use. Raises the bar on fatigue attacks. Still has a social engineering surface.
4. FIDO2 (Fast Identity Online 2) hardware keys (YubiKey): phishing-resistant by design. The origin-binding means an AiTM proxy fails the cryptographic check. Physical theft and account recovery fallbacks are the remaining vectors.
5. Passkeys: FIDO2 credentials managed by your device with biometric unlock. Same phishing resistance as hardware keys, with significantly better UX. Google reported over 800 million accounts using passkeys as of mid-2024, with passkeys used more often than SMS OTP and authenticator apps combined for Google sign-ins. Apple, Google, and Microsoft all support them natively. Most major US banks have not deployed them yet, but the consumer infrastructure is ready.

The near-term action isn't buying hardware keys for every account. It's an audit: identify every account using SMS or email OTP, rank them by the access they'd give an attacker, and migrate the top five to an authenticator app or passkey. Your primary email account comes first. It's the account recovery key for everything else.

If you've been through a breach or suspect your credentials are in circulation, the post-breach checklist covers locking down accounts under active threat. For the foundational hygiene that makes this upgrade path easier to execute, the account security hygiene guide is the right starting point.

MFA is not the finish line. It's the entrance requirement.