5 popular ways attackers bypass MFA

Multi-factor authentication stops most password attacks, so attackers aim at what sits around it: the person approving the prompt, the processes that reset or recover the account, and the session cookie the site hands out after a successful login. These five methods show up again and again:

1. Weak account recoveryA password reset or recovery flow that is weaker than the login itself. Keycloak CVE-2026-18963 (Aug 2026, CVSS 9.1) let an unauthenticated attacker skip the emailed reset token and set a new password for any account, admins included.
2. Push bombing (MFA fatigue)Endless approve prompts until you tap yes. Uber, 2022: an attacker then messaged the contractor posing as IT.
3. Help-desk resetThe attacker calls IT pretending to be you and asks to move your MFA to a new device, a Scattered Spider favourite.
4. SIM swapYour mobile carrier is tricked into moving your number, so SMS codes go to the attacker.
5. Infostealer cookie theftMalware on your PC copies session cookies after you have already passed MFA.

What works: make every way back into an account at least as strong as the login. Patch identity products quickly, test reset flows like any other login, and require MFA or a fresh identity check before a reset takes effect. Phishing-resistant MFA (passkeys and FIDO2 security keys) removes pushes and SMS codes altogether, as long as weaker fallbacks are switched off. It does not fix a broken reset flow, a help desk re-enrolling an attacker or malware stealing a cookie after login, so add strict caller verification, short-lived and device-bound sessions, and alerts on new devices and impossible travel.