MFA Bypass Techniques (AiTM, MFA Fatigue, and SIM Swapping): How a Single Click Shatters Your Corporate Network

No exploit. No broken algorithm. Just one annoyed tap at three in the morning – and a billion-dollar company was wide open.

Uber, 2022: an external contractor had valid credentials – most likely from an earlier leak. What was missing was the second factor. The attacker triggered it by repeatedly launching login attempts. Every attempt generated a new MFA push notification on the contractor's phone (Uber security update). Eventually, after a flood of these prompts, the contractor approved one of them. The attacker was in.

What makes this case remarkable: the MFA worked exactly as designed, technically speaking. No certificate was forged, no cryptographic key was broken. The authentication itself was valid – only the path leading to it had been compromised. From there, the attacker gained access to further employee accounts and picked up elevated permissions for internal tools such as G-Suite and Slack. They downloaded internal Slack messages and accessed a finance tool Uber uses to manage invoices.

This case is a textbook example of how LAPSUS$-style MFA bypasses work: multi-factor authentication isn't cracked cryptographically – it's circumvented by manipulating the identity processes surrounding authentication. Push-bombing, SIM swapping, session-token theft, and social engineering are the tools of the trade. Researchers see it as a clear warning sign of the risks that arise when organizations lean too heavily on MFA as their sole line of defense.

How do attackers actually defeat the second factor in practice, where are the weak points – and can you protect yourself against it?

2FA, MFA, and the three steps that come before them

Before getting into the attacks, it's worth a quick look at the terminology. Two-factor authentication (2FA) requires users to provide two different types of authentication before gaining access to an account – typically something you know (a password) combined with something you have (e.g. an OTP code). Even if one factor is compromised, the second one prevents unauthorized access.

Multi-factor authentication (MFA) is the broader term: it requires two or more additional factors beyond a username and password. 2FA is therefore a subset of MFA. While two factors are often enough for consumer applications, MFA combines knowledge (password), possession (token, smartphone), and inherence (biometrics) depending on the level of protection needed – usually wherever one or two security layers aren't sufficient.

To understand where MFA bypasses take hold, it helps to distinguish three steps that build on each other in every security architecture:

From uncomfortable extra to enterprise standard – and still exploitable

These two numbers illustrate the dilemma: MFA is no longer a niche topic, but in practice it often protects less than organizations assume – and most small teams don't even have a modern second layer of security in place.

Three common 2FA and MFA methods at a glance

"If the lock can't be picked, we'll just steal the key while the door's being opened."

A LAPSUS$-style MFA bypass occurs when authentication factors are technically validated, but attackers still gain access by manipulating identity signals before or during authentication. Rather than breaking encryption, these attacks exploit weaknesses in identity trust: credential theft, repeated MFA prompts, hijacked accounts, or stolen session tokens. The result is a login that looks entirely legitimate – even though the path leading to it was compromised.

1. Adversary-in-the-Middle (AiTM)

The attacker inserts a transparent relay between the victim and the real login page. The victim notices nothing, enters credentials and the OTP on the fake page – and the proxy captures the finished session cookie. Even a live-generated OTP code is useless, because the attacker hijacks the session in real time.

2. MFA fatigue & psychological wear-down

Also known as push-bombing: the attacker already has valid credentials and repeatedly triggers authentication prompts until a user approves one. What's exploited here is human approval behavior, a flood of notifications, limited context at the moment of approval, and weak identity verification beforehand. When AiTM doesn't work, brute force often follows: scripts flood the victim's phone with push prompts at three in the morning, combined with fake calls from "IT support" (vishing) – exactly as in the Uber incident described at the start.

3. Hijacking the possession factor: SIM swapping

In SIM porting, attackers redirect a phone number to a SIM card or device under their control in order to receive SMS messages or calls intended for the target number. Another example of how MFA can fail without the second factor itself ever being broken.

What happens in the first 60 seconds after the bypass?

How to defend against modern MFA bypasses

Beyond the fundamental shift to FIDO2, existing push-based methods can also be hardened considerably:

• Number matching: Entering a number shown on the login screen into the phone forces genuine, conscious interaction instead of a reflexive tap.
• Context-aware prompts: Showing location, IP, and app details with every push notification makes unusual login attempts immediately noticeable.
• Rate limiting: Automatically blocking after a set number of unanswered requests stops MFA fatigue attacks before they succeed.
• Avoid SMS as MFA: SMS codes as a second factor should be discouraged – and should not be used at all for especially high-value accounts.
• Prioritize an authenticator app or biometrics: These methods are significantly more secure and effective at protecting accounts than SMS-based approaches.

Classic methods – SMS codes and simple TOTP apps – are no longer enough against modern threat scenarios. The trend is moving unstoppably toward phishing-resistant MFA: FIDO2, passkeys, hardware security keys. Security here isn't a static state, but a continuous process of adapting between authentication convenience and risk reduction.