Multi-Factor Authentication is not infallible! 4 ways hackers use social engineering to bypass MFA

When it comes to access security, one measure stands out above the rest: Multi-Factor Authentication (MFA). For hackers, cracking passwords is simple, and MFA acts as a vital protective layer to prevent breaches. However, MFA is not foolproof; it can be bypassed, and this happens frequently.

If a password is compromised, hackers can employ various methods to bypass the additional protection of MFA. Below, we will explore four social engineering strategies that hackers successfully use to breach MFA, as well as the important role strong passwords play as part of a layered defense.

▌01 Adversary-in-the-Middle (AiTM) Attacks

An AiTM attack refers to deceiving users into believing they are logging into a genuine network, application, or website. In reality, they are leaking their information to hackers, which allows the hackers to intercept passwords and manipulate security measures, including MFA prompts. For example, a spear-phishing email might impersonate a trusted source and land in an employee's inbox; clicking the link embedded in the email will direct them to a fake website where hackers harvest their login credentials.

Ideally, MFA should prevent these attacks by requiring an additional authentication factor, but hackers can employ a technique known as "2FA pass-on". As soon as the victim enters their credentials on the fake website, the attacker immediately inputs the same details on the legitimate website. This triggers a legitimate MFA request, which is exactly what the victim expects, so they easily approve the request, thereby unintentionally granting the attacker full access.

This is a common tactic of threat groups like Storm-1167, which are known for crafting fake Microsoft authentication pages to harvest credentials. They also create a second phishing page that mimics the MFA step of the Microsoft login process, prompting victims to enter their MFA code and granting attackers access. From there, they can access legitimate email accounts and use them as a platform for multi-stage phishing attacks.

The Security Incident Validation Platform can help you verify whether your current security measures are sufficient to defend against "2FA pass-on" techniques. Search for "2FA" in the attack library to obtain attack simulations of malware that implements "2FA pass-on".

▌02 MFA Fatigue Attack (MFA Prompt Bombing)

This tactic exploits the push notification feature in modern authentication applications. After a password is compromised, attackers attempt to log in, thereby sending MFA prompts to the legitimate user's device. The user either mistakes it for a genuine prompt and accepts it, or chooses to accept it out of impatience with continuous prompts. This technique, known as MFA prompt bombing, poses a significant threat.

In one incident, hackers from the Lapsus$ group compromised an Uber contractor's login credentials via SMS phishing, then proceeded to authenticate from a machine under their control and immediately requested MFA codes. They then impersonated Uber security team members on Slack, tricking the contractor into accepting the MFA push notifications on their phone.

▌03 Help Desk Attacks

Attackers will pretend to have forgotten their password and trick the help desk via phone into bypassing MFA to gain access. If the help desk agent fails to perform proper verification procedures, they may unknowingly provide hackers with an initial entry point into their organization's environment. A classic recent incident is the attack targeting MGM Resorts, where the Scattered Spider hacker group fraudulently contacted the help desk for password resets, providing them with a foothold to log in and launch ransomware attacks.

Hackers also attempt to bypass MFA by manipulating the help desk to exploit recovery settings and backup procedures. If the MFA prompt bombing is proven unsuccessful, threat actors will target an organization's help desk. They will contact the help desk claiming their phone is unusable or lost, and then request the enrollment of a new, attacker-controlled MFA authentication device. They can then exploit the organization's recovery or backup processes by sending password reset links to the compromised device.

▌04 SIM Swapping Attacks

Cybercriminals know that MFA often relies on mobile phones as a means of authentication. They can exploit this through a technique known as "SIM swapping," in which hackers trick the service provider into transferring the target's service to a SIM card under their control. They can then effectively take over the target's mobile phone service and phone number, allowing them to intercept MFA prompts and gain unauthorized access to accounts.

Following events in 2022, Microsoft released a report detailing the tactics employed by the threat group LAPSUS$. The report explained how LAPSUS$ committed to extensive social engineering campaigns to gain an initial foothold in target organizations. One of their favorite techniques was targeting users through SIM swapping attacks, alongside MFA prompt bombing, and resetting target credentials through help desk social engineering.

The Security Incident Validation Platform can help you verify whether your current security measures are sufficient to defend against the numerous attack methods used by the "LAPSUS$" threat group. Search for "LAPSUS$" in the attack library to obtain attack methods related to the "LAPSUS$" threat group and conduct attack simulations.

▌Note: Do not rely solely on MFA, password security remains crucial

Methods to bypass MFA are not limited to the above; other ways include compromising endpoints, exporting generated tokens, exploiting SSO, and finding unpatched technical flaws. Clearly, setting up MFA does not mean organizations can completely do away with protecting passwords.

Account compromise still often starts with weak or compromised passwords. Once attackers obtain a valid password, they can turn their attention to bypassing MFA mechanisms. If passwords are compromised due to breaches or reuse, even strong passwords cannot protect users. For most organizations, going completely passwordless is not a practical option.