Multi-factor authentication (MFA) was once hailed as a near-perfect shield, yet recent headline breaches prove attackers are not only slipping past it—they are doing so at an accelerating pace. This report ranks today’s most common MFA combinations from weakest to strongest and quantifies the sharp rise in MFA-related attacks between 2023 and 2025. It should be noted that PhotolokÒ (a passwordless MFA factor that uses proprietary-coded photos) is not included in this analysis.
Why MFA Strength Varies
Every MFA scheme marries at least two factors—knowledge (password/PIN), possession (token/phone), or inherence (biometric). Security depends on:
Transport security (Is any secret sent over a channel that can be intercepted?)
Phishing resistance (Can the user’s factor be replayed to a fake site?)
Device binding (Is the factor cryptographically locked to a specific device?)
User behavior (Can social engineering or “MFA fatigue” trick users into approving?)
Should be phased out per CISA and NIST guidance 2, 14
Key Takeaways
SMS and voice codes are now the attacker’s easiest door. SIM-swapping and SS7 attacks routinely hijack these one-time codes 12, 13.
Push bombing moved classic push to “low trust.” Repeated prompts trick users into approvals; number-matching mitigates but doesn’t eliminate risk 10, 9.
TOTP is safer than SMS but still phishable. Transparent reverse-proxy kits like EvilProxy harvest codes in real time 9.
Phishing-resistant authentication begins with FIDO2/WebAuthn. Hardware-backed keys or passkeys neutralize man-in-the-middle attacks by binding credentials to the correct origin 12.
The Surge in MFA-Focused Attacks (2023-2025)
Year
Representative Study
Metric Reported
Indicator of MFA Attack Activity
2023
Okta “State of Secure Identity 2023”
12.7% of all MFA attempts on Okta’s Customer Identity Cloud were outright bypass attacks 15
Baseline showing bypass in production traffic
2023
Kroll “Rise in MFA Bypass” (Oct 2023)
90% of BEC cases investigated had MFA in place when accounts were compromised 16
Confirms attackers pivoting to MFA-enabled targets
2024
Cisco Talos IR Q1 2024
≈50% of incident-response cases involved failure or bypass of MFA controls 10, 17
Doubling of bypass prevalence over 2023 baseline
2024
Proofpoint “State of the Phish 2024”
Phishing frameworks such as EvilProxy observed in ≈1 million threats per month, explicitly harvesting MFA cookies 18
Commodity kits fueling large-scale bypass
2025
Netrix Global “New Wave of MFA Bypass Attacks” (Jun 2025)
Advises a “surge” but no percentage; corroborated by FRSecure IR 2024-25 where 79% of BEC victims had correctly implemented MFA yet were breached 19
MFA bypass now dominant in BEC incidents
2025
eSentire Q1 2025 Report
BEC attacks (often MFA bypass via Tycoon 2FA) rose 60% YoY, now 41% of all attacks 20
*Rates come from different datasets (CIAM traffic, IR engagements, BEC breaches). While scopes vary, all show the same climbing trajectory.
Why the Rate Keeps Rising
Commodity Phishing-as-a-Service (PhaaS)
Kits like Tycoon 2FA and EvilProxy package adversary-in-the-middle techniques for <$300 20, 21.
No elite skills required; proxy auto-captures TOTP, push, and even session cookies.
Token Theft & Session Hijacking
Malware or browser extensions steal stored cookies, rendering second factors moot 9, 19.
Stolen session tokens sell in criminal markets for as little as $10 per corporate user 20.
MFA Fatigue & Social Engineering
Push-bombing remains effective: Uber, Microsoft, and EA all fell to approval spamming 11, 9.
Help-desk impersonation convinces IT staff to reset credentials or enroll attacker devices 16.
Weak Factor Mix
SMS remains the default in consumer apps—96% of Coinbase account-takeover victims relied on SMS OTP 13.
Many enterprises lack Conditional Access or token-binding, letting hijacked sessions roam free 22.
Hardening the Human-Machine Perimeter
1. Phase Out Legacy Factors
Block SMS/voice codes for privileged accounts; require authenticator apps or keys instead12, 2.
2. Enforce Phishing-Resistant MFA
Deploy FIDO2/WebAuthn passkeys or security keys for all admins and high-risk roles 12.
Use token-binding or Microsoft Entra ID’s token protection to neutralize session-theft attacks 22.
3. Strengthen Push Workflows
Mandate number-matching or challenge-response for any push-based approvals 9.
Limit consecutive push requests and alert security operations on excessive prompts 11.
4. Layer Conditional Access & Risk-Based Controls
Require device compliance, geolocation heuristics, and continuous session monitoring to catch hijacked tokens in flight 22.
5. Educate to Eradicate MFA Fatigue
Simulate AiTM phishing and push-bomb drills so users recognize and report anomalies 23, 16.
Reinforce “never approve unexpected prompts” in monthly training cycles.
Conclusion
Attackers’ ability to sidestep MFA has grown from isolated exploits in 2023 to industrial-scale commodity services in 2025. Organizations that cling to password-plus-SMS or push-only MFA now occupy the bottom rung of the strength ladder and face a sharply rising threat curve. Yet the solution is within reach: broad adoption of phishing-resistant, device-bound authentication—coupled with risk-aware access controls—flips the cost curve back onto the attacker. Upgrade the factors, shrink the attack surface, and keep users from approving the next rogue prompt. One novel method of upgrading factors is to use Photolok – a passwordless factor that uses steganographic coded photos that also protects against AI/ML attacks as well as provides lateral movement penetrations due to its unique architecture.
We use cookies to ensure that we give you the best experience on our website. If you continue to use this site we will assume that you are happy with it.Ok
