How Cybercriminals Bypass Multi-Factor Authentication with Phishing Websites

In today’s digital world, using strong passwords and enabling multi-factor authentication (MFA) is considered essential for protecting your online accounts. But what if that still isn't enough?

You may be surprised to learn that cybercriminals can bypass MFA protections by tricking users into visiting malicious websites. In this blog post, we'll break down how attackers do this—using tools freely available online—and what you can do to stay safer.

Watch the Demo

Note: This information is for educational purposes only.
The following scenario was performed in a secure lab environment to demonstrate how these attacks work so you can better defend against them.

The Attack in Action: A Step-by-Step Breakdown

1. The Phishing Email

The attack begins with a carefully crafted phishing email. The victim receives a message prompting her to log into her Microsoft Office 365 account. Unaware of the threat, she clicks the link.

2. The Fake Login Page

The link leads to a malicious server that sits between the user and the real service. When the victim visits the fake domain, the malicious server fetches the real login page from Microsoft and forwards it to the user. So the users think they are visiting the target site. As the victim enters her username and password, the attacker’s server captures the credentials in real-time.

3. MFA Prompt and Cookie Theft

Next, the victim is prompted to enter her MFA code from an authenticator app. She enters the code, thinking everything is normal. But behind the scenes, the attacker uses a man-in-the-middle proxy to steal her session cookies—the small pieces of data that websites use to keep users logged in.

4. Hijacking the Session

With the stolen cookies in hand, the attacker opens a new browser session and injects those cookies using a browser plugin. Once refreshed, the attacker is fully logged into the victim’s account—without needing the password or MFA code.

Why MFA Isn’t Foolproof

This attack illustrates a key weakness in MFA: it protects against unauthorized logins, but not if the attacker can hijack your session after you authenticate. As long as the attacker can act as an invisible proxy between you and the real website, they can steal both your login and your active session.

How to Protect Yourself

  • Never click on suspicious links.
    Be cautious with emails or messages urging you to log in quickly or click on links. When in doubt, navigate to the site manually.
  • Use a phishing resistent MFA
    FIDO2 (Fast Identity Online) security keys (z.B. Yubikey) and Passkeys offer additional protection by binding the login to a physical device and verifying the website you are connecting to. This makes it significantly harder for attackers to silently insert themselves between you and the legitimate website.
  • Enable session monitoring and alerts.
    Some services offer notifications when your account is accessed from a new location or device. Enable these whenever possible.
  • Educate your team.
    Phishing is a social engineering attack. Regular security training can drastically reduce the chances of someone falling for a scam.
Our Trainings

Final Thoughts

Multi-factor authentication is still a crucial layer of defense, but it’s not invincible. As shown in this demonstration, attackers can exploit users with sophisticated phishing tools that look and feel legitimate.

The best protection is a combination of technology and awareness. Stay vigilant, and when in doubt, don’t click.

If you found this helpful, feel free to share it with your colleagues. Stay safe out there!

FAQ