Loading
Loading
We use strictly necessary cookies to run this site, and analytics cookies to understand how it's used. See our Privacy Policy for details.
Push bombing, adversary-in-the-middle phishing kits, SIM swapping, the real techniques that defeat weak MFA, and why CISA specifically calls out phishing-resistant MFA.
Multi-factor authentication is one of the highest-leverage controls available, and it isn't the unconditional guarantee it's often sold as. CISA's own MFA guidance is explicit about this distinction: not all MFA is equally resistant to being bypassed, and the agency specifically urges organizations toward phishing-resistant MFA rather than treating "MFA enabled" as a single, uniform checkbox.
Push-notification MFA, approve or deny a login from your phone, is convenient, and it's also the weakest common form once an attacker already has a valid password. Push bombing exploits simple human fatigue: the attacker repeatedly attempts to log in with the stolen credential, firing off push notification after push notification, often late at night, until the target, annoyed, half-asleep, or simply assuming it's a glitch, taps "approve" just to make the notifications stop. No technical vulnerability is exploited; the authentication system works exactly as designed. CISA's guidance specifically recommends number-matching (the user must enter a code shown on the login screen into the push prompt) as a mitigation short of full phishing-resistant MFA, precisely because it breaks the "just tap approve" reflex.
This is the technique that defeats most MFA that isn't phishing-resistant, including one-time codes and standard push approval. Rather than a static phishing page that just steals a password, an AiTM kit (Evilginx is the best-known open-source example) proxies the real login flow in real time: the victim enters their password and MFA code into what looks like the genuine site, the kit relays those credentials to the real service, and, critically, captures the resulting session cookie or token after MFA succeeds. From that point, the attacker has a fully authenticated session without ever needing to see a reusable credential, because the token itself, not a password, is what gets stolen.
For MFA that relies on SMS codes specifically, SIM swapping bypasses the second factor entirely by attacking the phone number instead of the account. Through social engineering against a mobile carrier, or an insider at one, an attacker gets the victim's phone number ported to a SIM card they control, after which any SMS-based MFA code goes straight to the attacker's device. This is exactly why SMS is the weakest widely-deployed MFA factor, and why FIDO2/WebAuthn hardware keys, bound cryptographically to the specific site and device, not to a phone number, are what CISA specifically classifies as phishing-resistant.
"We have MFA" is a materially different claim than "our MFA resists the techniques attackers actually use," and the gap between the two is exactly what a real assessment tests for. Our Microsoft 365 Assessment reviews Conditional Access policy and MFA method strength specifically, and our social engineering assessments test whether push-bombing and AiTM-style phishing actually succeed against real users, not just whether MFA is technically switched on. For the related attack these techniques often chain into once an attacker has a session, see Business Email Compromise, explained.
Tell us about your environment and goals, we'll help you scope the right engagement.