MFA bypass

MFA was on. The attacker got in anyway. Here is how.

Text codes, push approvals and app codes all stop automated password attacks. None of them stop a fake sign-in page that relays the code in real time. Here is how attackers get past MFA, what actually stops them, and a check of the routes open in your business.

Essential Eight position from ASD's Blueprint; Microsoft dates from Microsoft Learn. Checked 31 October 2026.

Book a sign-in review Check your routes 07 3114 2808

Six bypass routes
What resists them
Open-route check

Reviewed by Blake Bath, General Manager, on 31 October 2026.

A hand holds a small hardware security key beside a laptop and a phone on a timber desk. — **Bound to the real site**Passkeys and security keys cannot be relayed by a fake sign-in page.

How it happens

Six ways attackers get past MFA.

Fake sign-in pages are the most common. Adversary-in-the-middle was 18.9% of identity threats in Huntress's 2026 data.

Fake sign-in pages

A phishing kit relays the password and code to the real page and keeps the session.

Passkeys
Token protection
Detection

MFA bypass route check

Which bypass routes are open in your business?

Four questions about how people sign in and get reset. You get the open routes and the order to close them.

Tell us how people sign in today. You get the bypass routes that are open and the order to close them.

How do admins sign in?

How do most staff sign in?

When someone loses their phone, the help desk resets MFA

Is legacy sign-in blocked?

Your MFA today

Can be phished

Admins: a fake sign-in page can relay authenticator push and steal the session.
Admins: repeated prompts can wear someone down. Number matching helps but does not stop a relayed sign-in.
Staff: a fake sign-in page can relay authenticator push and steal the session.
Staff: repeated prompts can wear someone down. Number matching helps but does not stop a relayed sign-in.
Help desk: a convincing caller can get MFA reset on a single call.
If legacy sign-in is still open, it skips MFA entirely.

Next steps, in order

Move admins to passkeys or security keys first, and require it with a Conditional Access authentication strength.
Roll passkeys or Windows Hello out to staff, starting with finance and executive assistants.
Require a call back on a known number or a manager check before any MFA reset.
Block legacy authentication with one Conditional Access policy.
Malware on a device can still steal a signed-in session. Keep devices managed and have someone watching for token replay.

Harden our sign-in

What each method stops

Not all MFA is equal.

Method	Fake sign-in page	Push spam	SIM swap
SMS or voice codes	Falls	Not affected	Falls
Authenticator push (number matching)	Falls	Reduced	Not affected
Authenticator codes	Falls	Not affected	Not affected
Passkey or security key	Resists	Not affected	Not affected
Windows Hello for Business	Resists	Not affected	Not affected

No sign-in method stops malware stealing a session that is already signed in. That needs managed devices and monitoring.

What resists

The methods that a fake page cannot relay.

PasskeysStored on a phone or laptop, unlocked with a face, fingerprint or PIN. Now supported across Microsoft 365.
FIDO2 security keysA physical key on a keyring. The strongest option for admins.
Windows Hello for BusinessA key held in the device's security chip, unlocked by face or PIN.
Certificate-based sign-inStrong, with more setup. Suits regulated environments.

What is expected

Where the standards and Microsoft are heading.

Essential Eight Maturity Level TwoPhishing-resistant MFA for users of online services with sensitive data and for users of systems.
Microsoft SMS and voice retirementFrom 1 February 2027 in Entra ID, with Global Admins following on 1 July 2027.
Number matchingMicrosoft Authenticator push already requires number matching, which reduces blind approvals.
Cyber insuranceInsurers ask about MFA on email, remote access and admin accounts at renewal.

Our view

Start with the people who can do the most damage.

Admins, finance and executive assistants move to passkeys or security keys first. That is a small group, it is fast to do, and it covers the accounts attackers want most.

Then everyone else, with Windows Hello on managed laptops and passkeys on phones. Alongside that we fix the help desk reset process and block legacy sign-in, because those two routes skip MFA no matter how strong it is.

The order

Moving to phishing-resistant MFA in five steps.

Step 1Audit methods
Who uses what, from the sign-in logs.
Step 2Admins first
Security keys or passkeys, enforced by policy.
Step 3Fix the gaps around MFA
Help desk resets and legacy sign-in.
Step 4Everyone else
Passkeys and Windows Hello, SMS removed.
Step 5Watch for what gets through
Token replay and app consent detection.

Related guides

Stronger sign-in. Then catch what slips past.

Passkeys, MFA basics, detection and email fraud.

Get help your way

Six ways to reach us. Pick whichever suits you.

Helpdesk hours are Monday to Friday, 8am to 5pm AEST. On Advantage and above, emergencies get a response within 1 hour and outages within 2, with 24/7 best-effort escalation.

Questions

What people ask about MFA bypass.

Can MFA be bypassed?

Yes. Text codes, push approvals and app codes can all be relayed by phishing kits that sit between the user and the real sign-in page. Push can also be approved by a tired user, and text codes can be stolen with a SIM swap. MFA still blocks most automated attacks, which is why it stays essential.

What is phishing-resistant MFA?

Sign-in that is cryptographically tied to the real website, so a fake page cannot relay it. Passkeys, FIDO2 security keys, Windows Hello for Business and certificate-based sign-in all qualify.

What is an adversary-in-the-middle attack?

A phishing kit acts as a go-between for the real sign-in page. The user enters their password and MFA, the kit passes them through, and keeps the session token that comes back. The attacker then uses that token to sign in as the user.

Does the Essential Eight require phishing-resistant MFA?

At Maturity Level Two, yes, for users of online services holding sensitive data and for users of systems. Maturity Level One accepts any MFA type. Most organisations target Level Two.

Is Microsoft retiring SMS MFA?

Yes. Microsoft-provided SMS and voice MFA in Entra ID retires from 1 February 2027, with Global Admins following on 1 July 2027. Users whose only method is SMS or voice will be pushed to set up a passkey.

Do passkeys stop all account takeover?

They stop the fake sign-in page. They do not stop malware on a device stealing a session that is already signed in, or a help desk resetting MFA for the wrong person. Managed devices, a verified reset process and identity monitoring cover those.

Next step