If you turned on multi-factor authentication a few years ago and haven't thought about it since, you're not alone. Most businesses set up MFA and figured they were covered. The problem is the attackers have been busy, and they've figured out workarounds.
MFA works — until it doesn't
Microsoft's own data shows that MFA blocks roughly 99.9% of automated account compromise attempts. That's a real statistic, and it's why every security framework on the planet recommends MFA as a baseline requirement. But “99.9%” leaves room for a meaningful number of failures when you consider the volume of attacks targeting businesses today.
The two attack patterns that have been growing over the past year are MFA fatigue (also called push bombing) and adversary-in-the-middle (AiTM) attacks. Both are well-documented by cybersecurity researchers and government agencies, including CISA and the FBI.
MFA fatigue: death by a thousand notifications
Push-based MFA — the kind where you get a notification on your phone and tap “Approve” — is the most common type used by SMBs. It's also the most vulnerable to fatigue attacks. Here's how it works: an attacker obtains a user's password (phishing, credential stuffing, buying it off the dark web) and starts logging in. The user gets a push notification. They deny it. Another one comes. They deny it again. This repeats, sometimes dozens of times in a few minutes.
Eventually, someone clicks “Approve” by accident. Maybe they think it's a glitch. Maybe they're tired of the interruptions. In the high-profile Uber breach from 2022, the attacker used this exact technique — and it worked. That same tactic is now being used against small businesses, not just billion-dollar companies.
AiTM attacks: the proxy in the middle
Adversary-in-the-middle attacks are more sophisticated. The attacker sets up a proxy that sits between you and the real Microsoft 365 login page. You type your credentials into what looks like a normal sign-in screen. The proxy forwards them to Microsoft. Microsoft sends back an MFA challenge. The proxy forwards that to you. You complete the MFA. The proxy captures the session token that Microsoft issues — and now the attacker has a fully authenticated session. They don't need your password anymore.
Microsoft's Threat Intelligence team reported a significant increase in AiTM attacks starting in mid-2022, and the technique has only become more common since. Because the proxy captures the session token rather than the credentials, the attacker can bypass MFA without the user ever realizing anything went wrong.
What to actually do about it
The solution isn't to abandon MFA — that would be like removing the locks from your doors because someone learned to pick them. The solution is upgrading to phishing-resistant MFA. This is a term the U.S. government now uses in its official guidance: MFA methods that cannot be phished.
Phishing-resistant MFA options
- ✓FIDO2 security keys (YubiKey, Google Titan): Physical USB or NFC devices that only work on the correct website. They cannot be phished because they cryptographically verify the domain they're authenticating to.
- ✓Passkeys: The newer, platform-native version of FIDO2. Built into Windows, macOS, iOS, and Android. Works the same way — tied to the specific website or app.
- ✓Number matching: If you can't move to hardware keys yet, at minimum enable number matching in Microsoft Authenticator. Instead of a simple Approve/Deny push, it requires typing a two-digit number displayed on the login screen. This stops MFA fatigue because the user needs the number from the screen to approve the login.
For most SMBs, the practical path looks like this: start by enabling number matching in your existing MFA solution (it's usually a single checkbox in the admin console). Then pick a group of your highest-risk users — finance, executives, IT admins — and deploy FIDO2 keys or passkeys for them. Expand from there as budget and time allow.
The key takeaway is that MFA alone, especially push-based MFA, is no longer the finish line. The attackers have adapted. Your authentication strategy should too.