- Stolen or compromised credentials are the primary initial access method in over 80% of enterprise breaches, according to Verizon's DBIR. The rise of adversary-in-the-middle attacks has made this position more entrenched, not less.
- Adversary-in-the-middle (AiTM) proxy attacks bypass TOTP codes and push notifications by proxying the authentication in real time and stealing the resulting session token. The user sees a normal login flow.
- Only phishing-resistant MFA — FIDO2 passkeys or hardware security keys — stops AiTM attacks at the authentication layer, because the cryptographic challenge is bound to the legitimate origin URL.
- Pass-the-cookie attacks replay stolen session tokens without needing credentials or MFA at all. Token lifetime policies, Conditional Access with device compliance, and Continuous Access Evaluation (CAE) are the primary defences.
- MFA fatigue attacks bombard users with push notification requests until they approve one out of exhaustion or confusion. Number matching and additional context in push notifications significantly reduce approval rates.
- A complete credential defence strategy requires phishing-resistant MFA for privileged accounts, Conditional Access enforcing device compliance, short session token lifetimes, and monitoring for impossible travel and token replay anomalies.
Credentials are the primary breach vector
For most of the 2010s, the narrative around enterprise breaches focused on malware: ransomware groups, nation-state implants, zero-day exploits. The picture has changed substantially. Attackers have shifted to credential theft because it is cheaper, faster, and harder to detect. A legitimate user account signing in through an authorised identity provider looks exactly the same as a normal login to most monitoring systems.
The Verizon Data Breach Investigations Report documents this shift clearly: stolen credentials were involved in over 80% of hacking-related breaches in recent years. The number of credentials available to attackers has grown in parallel. HaveIBeenPwned indexes over 13 billion breached accounts sourced from hundreds of historical data breaches. Credential stuffing tools can test these against target services at scale, with request throttling and IP rotation to avoid rate-limiting defences.
Adding MFA was the right response. And it works against credential stuffing and most automated attacks. The problem is that attackers adapted. A subset of credential attacks now specifically targets the authentication session rather than the credentials themselves, and standard MFA factors provide no protection against them.
Six bypass methods you need to know
Not all credential attacks are equal. Understanding how each one works is necessary to choose the right controls, because a defence that stops credential stuffing may do nothing against session token theft.
What each MFA type actually stops
The choice of MFA factor matters significantly. SMS OTP and push notifications stop automated credential stuffing but provide no protection against a real-time AiTM attack. Understanding where the protection ends helps you prioritise which controls to upgrade first.
* FIDO2 stops AiTM at authentication but does not protect session tokens after a legitimate login. Device compliance and CAE are required for post-authentication session security.
What makes FIDO2 different
Every other MFA factor generates a code or prompt that can be forwarded. A six-digit TOTP code, a push notification approval, an SMS message — all of these can be intercepted or forwarded by a proxy in real time. The user completes the challenge; the proxy relays it. The session is established. The proxy takes the cookie.
FIDO2 passkeys and hardware security keys work differently. The private key is stored on the device or in the platform authenticator and never leaves it. The cryptographic signature is generated in response to a challenge that includes the origin URL of the requesting site. If a phishing domain at login-microsoft-365.com requests a FIDO2 signature, the challenge includes that domain. The browser compares it to the registered origin (login.microsoft.com) and refuses to sign. No credential is transmitted. The proxy gets nothing.
This is why FIDO2 is the only factor classified as phishing-resistant under NIST SP 800-63B and why CISA and NCSC both recommend it for high-value accounts.
Push notifications without number matching can be approved by a user who is confused by repeated requests, even without malicious intent. Microsoft's own data shows that number matching reduces approval rates during push bombing attacks by over 99%. If you are currently using push notifications, enabling number matching is a free configuration change that substantially raises the bar for MFA fatigue attacks.
Defending against session-layer attacks
Session token theft sits outside the authentication boundary. By the time a token is stolen, the authentication event is already complete. The controls here operate on the session lifetime and device binding rather than on the initial login.
Token lifetime policies
Long-lived access tokens give attackers extended windows to exploit stolen sessions. Entra ID token lifetime policies can reduce refresh token and access token lifetimes for sensitive applications. The tradeoff is user friction: shorter sessions mean more frequent re-authentication. Continuous Access Evaluation (CAE) offers a better solution for supported applications by revoking tokens in near real time when Entra ID detects a risk event, such as a sign-in from an impossible travel location or a reported credential compromise.
Device binding through Conditional Access
Conditional Access policies that require device compliance check whether the device attempting to use the session is the same managed, compliant device that established it. A session token replayed from an unmanaged attacker device fails the compliance check and is blocked or requires re-authentication. This significantly reduces the utility of stolen tokens even when the attacker holds a valid one.
Monitoring for token anomalies
Impossible travel alerts flag sign-ins from geographically separated locations within a timeframe that no human could achieve. A legitimate user who authenticates in Amsterdam at 09:00 cannot also be authenticating in Moscow at 09:15. These detections in Entra ID Identity Protection and in Microsoft Sentinel are among the highest-fidelity signals for session token replay in cloud environments. They should generate automated responses: session revocation, forced re-authentication, or security team notification depending on severity.
Start with privileged accounts
The return on investment for phishing-resistant MFA is highest on accounts with the most access. Administrative accounts, service accounts with elevated permissions, finance team accounts, and board-level executives represent the smallest user population but the largest potential impact of a successful credential attack.
Enforcing FIDO2 on all users in a large organisation takes time: it requires device distribution, user training, and policy rollout. Enforcing it on the 20 accounts that matter most can be done in days. Start there. Extend Conditional Access policies to require phishing-resistant authentication for privileged role access. Apply PIM (Privileged Identity Management) to ensure administrative roles are never permanently active. Those steps alone remove the most valuable targets from reach of AiTM attacks.
A compromised administrator account with TOTP-based MFA gives an attacker full tenant access in under ten minutes. The same attack against a FIDO2-protected account gets them nothing.
Seven controls to implement now
- Enable number matching on all push MFA — free configuration change in Microsoft Authenticator that stops push bombing attacks
- Block legacy authentication protocols — SMTP AUTH, POP3, IMAP, and older Office clients cannot complete MFA challenges; blocking them removes the most common credential stuffing path
- Enforce phishing-resistant MFA for privileged accounts — Conditional Access authentication strength policies can require FIDO2 for administrative roles immediately
- Enable Entra ID Identity Protection — real-time risk scoring of sign-ins, leaked credential detection from HIBP integration, and automated response policies
- Configure Continuous Access Evaluation — near real-time token revocation for Microsoft 365 applications when risk events are detected
- Restrict OAuth application consent — prevent users from consenting to unverified third-party applications by setting tenant-wide consent policies in Entra ID
- Monitor impossible travel and new device sign-ins — configure alerting rules so that anomalous session patterns generate immediate notifications or automated revocation