For years, the cybersecurity industry sold multifactor authentication as the definitive answer to credential theft. Add a second factor and you’re protected. The 2025 breach data says otherwise. Two specific techniques – real-time phishing proxies and push notification fatigue – are now dismantling that assumption at scale, and small and mid-sized businesses are absorbing a disproportionate share of the damage. If you want an honest conversation with your IT firm about authentication, you need to understand how these MFA bypass attacks actually work.
- The 2025 Threat Landscape: Why MFA Is Being Targeted Directly
- Technique One: Real-Time Phishing Proxies (Adversary-in-the-Middle)
- Technique Two: Push Notification Fatigue (MFA Bombing)
- Who It Affects: The SMB Exposure Profile
- Real-World Examples From Public Breach Disclosures
- Defense Posture: What Actually Works in 2025
- What to Ask Your IT Firm Right Now
The 2025 Threat Landscape: Why Attackers Have Moved Past Passwords
The FBI’s Internet Crime Complaint Center reported over $16.6 billion in cybercrime losses in 2024 – its highest figure on record – with business email compromise and credential-related fraud accounting for the largest single category of financial damage. The 2025 mid-cycle data and a series of high-profile breach disclosures confirm the same shift: attackers have largely stopped brute-forcing passwords. They’re now engineering attacks that intercept or exhaust the authentication layer itself.
The logic is straightforward. Credential hygiene improved. Password managers went mainstream. Enterprise identity platforms hardened password policies. So the path of least resistance moved one step downstream – to the verification step that comes after the password. Two techniques account for the overwhelming majority of MFA compromise events in 2025 public disclosures: adversary-in-the-middle phishing proxies and push notification fatigue. Each deserves a plain-language explanation.
Technique One: Real-Time Phishing Proxies (Adversary-in-the-Middle)
A real-time phishing proxy is a server that sits invisibly between a victim and a legitimate login page. The victim believes they’re typing credentials into their real Microsoft 365, Google Workspace, or banking portal. They’re not. They’re interacting with a spoofed page that instantly relays every keystroke – including the one-time code from their authenticator app – to the attacker’s server, which uses those credentials against the real service in real time.
The critical detail is “real time.” Traditional phishing stole credentials and replayed them later. Session cookies and time-limited one-time passwords made that replay window too narrow to be useful. Real-time proxies close that gap entirely. By the time the victim finishes logging in, the attacker already has an authenticated session on the legitimate platform.
Open-source toolkits – Evilginx, Modlishka, and Muraena are the most documented – have made this attack accessible to threat actors with modest technical skill. CISA’s advisory on phishing-resistant authentication, published as part of its ongoing MFA guidance series, specifically calls out adversary-in-the-middle phishing as the reason time-based one-time passwords are no longer sufficient for high-value accounts.
The implications are significant. Any authentication method that transmits a code the user types – SMS codes, authenticator app codes – is theoretically interceptable by a well-constructed proxy. The attacker doesn’t need to break the cryptography. They just need to capture the token before it expires. These MFA bypass attacks are a documented, scalable threat against businesses of every size.
Technique Two: Push Notification Fatigue (MFA Bombing)
Push notification fatigue operates on an entirely different principle. No technical interception required. The attacker obtains valid credentials through a phishing email or credential-dump purchase, then triggers rapid, repeated push notification requests to the victim’s registered device. Dozens of “Approve this login?” prompts flood the victim’s phone over minutes or hours.
The attack relies on a predictable human response: the victim approves a notification to make the noise stop, without verifying they initiated a login. This isn’t a technology failure. It’s a failure of the assumption that a person will scrutinize every notification under high-volume conditions.
The Uber breach of 2022 remains the most publicly documented large-scale example. The attacker purchased credentials from the dark web, sent MFA push requests until the employee grew frustrated, then sent a WhatsApp message posing as Uber IT asking the employee to approve the notification. The employee did. The attacker had full network access within minutes. The Lapsus$ group used nearly identical techniques against multiple technology companies during the same period. What was once a sophisticated nation-state technique is now a documented playbook used by loosely organized criminal groups against targets of any size.
The 2025 picture is worse. Commodity attack platforms now automate the bombing phase. An attacker running several campaigns simultaneously can trigger push floods against dozens of targets with minimal manual effort. MFA bypass attacks of this type require no advanced tooling – just stolen credentials and persistence.
Who It Affects: The SMB Exposure Profile
Both of these MFA bypass attacks disproportionately affect small and mid-sized businesses for structural reasons, not incidental ones.
- Most small businesses deploy time-based one-time password or SMS-based MFA because it’s the easiest option to roll out – and that’s precisely the tier these attacks are designed to defeat.
- Small businesses typically lack dedicated security monitoring. A successful session hijack using a phishing proxy may not surface an alert until days or weeks later, if it generates one at all.
- Security awareness training at the small business level is often annual-at-best and rarely covers the specific behavioral pattern that push fatigue exploits.
- IT vendors serving small businesses frequently present MFA as a complete control rather than one layer in a defense posture – creating a false sense of closure that discourages further investment.
- Credential stuffing databases are heavily weighted toward consumer accounts, and many employees reuse personal credentials on work platforms, creating ready-made attack lists at low cost.
The FBI’s 2024 report noted that businesses with fewer than 100 employees represented the largest single victim category by complaint volume for business email compromise – which is frequently the end goal once an attacker has defeated MFA and controls a mailbox. Financial damage per incident at the small business level tends to be proportionally larger because wire fraud and invoice manipulation rarely triggers the same transaction-monitoring flags that large enterprises have in place.
Real-World Examples From Public Breach Disclosures
Beyond Uber, the public record of 2023 – 2025 breach disclosures shows a consistent pattern. In each case, MFA bypass attacks were the pivotal technique – not password theft alone.
- The MGM Resorts breach of 2023, attributed to the Scattered Spider group, began with a social engineering call to the IT help desk and escalated using push fatigue tactics to gain access to identity platform administrator credentials. Estimated losses exceeded $100 million.
- Microsoft disclosed in January 2024 that a Russian state-sponsored group used a legacy account without MFA as an initial foothold, then used token theft techniques to move laterally through production systems. The post-breach analysis specifically flagged the inadequacy of certain legacy authentication flows.
- Cloudflare disclosed a breach attempt in February 2024 in which support system credentials were used in a real-time proxy attack. Cloudflare contained it because they had already migrated to hardware security keys – the one authentication method that is architecturally resistant to proxy interception – but the attack itself successfully obtained a valid session token before their detection controls flagged it.
- Throughout 2024 and into 2025, CISA’s Known Exploited Vulnerabilities catalog has seen a consistent stream of identity platform vulnerabilities that reduce MFA effectiveness when patch cadence is slow – a known weak point for smaller businesses.
The throughline is the same in every case: the authentication method was technically present and technically functional. It was bypassed, not broken. That distinction matters when evaluating whether your current posture is actually protective.
Defense Posture: What Actually Works Against MFA Bypass Attacks in 2025
No single control is sufficient. But specific controls are meaningfully harder to bypass than others, and the gap between them is now large enough to drive real investment decisions.
Phishing-resistant authentication methods. Hardware security keys (the FIDO2/WebAuthn standard) and passkeys are the only authentication factors that are architecturally immune to real-time phishing proxies. Because the cryptographic handshake is bound to the specific domain the user is visiting, a spoofed proxy page cannot complete the authentication – even if the user interacts with it. CISA and the National Institute of Standards and Technology (NIST) Digital Identity Guidelines both identify FIDO2-compliant authentication as the target state for high-value accounts. Migrating executive and finance team accounts to hardware keys is a proportionate, cost-effective hardening step for most small businesses.
Number matching in push notifications. Microsoft, Okta, Duo, and most major identity platforms now offer number matching – the user must type a number displayed on the login screen into their authenticator app, rather than simply tapping “approve.” This directly defeats push fatigue bombing by requiring the attacker to be in front of the same screen as the victim. Enabling number matching costs nothing and eliminates the most common push fatigue attack vector. If your platform isn’t running number matching today, that’s a configuration gap, not a product gap.
Conditional access policies. Modern identity platforms can evaluate login requests against context signals – device compliance status, geographic location, network, time of day. An authentication request originating from an unexpected country at 2 a.m. on a non-enrolled device shouldn’t succeed regardless of whether the MFA token was valid. Conditional access policies are standard configuration work on any Microsoft Entra ID or Google Workspace tenant – not an exotic add-on.
Token lifetime management. Real-time phishing proxy attacks steal session tokens. Shortening token lifetimes – combined with requiring re-authentication for high-sensitivity actions – limits the damage a stolen token can do. This is a configuration decision, not a product purchase.
Security awareness training with behavioral specificity. Generic “don’t click phishing links” training doesn’t address push fatigue. Employees need one simple, memorable rule: if you receive a push notification you did not initiate, deny it and report it. That behavioral anchor – deny and report – is specific enough to be actionable under the cognitive load of a push bombing attack.
Monitoring for anomalous authentication events. A phishing proxy attack that successfully captures a session token will show up as a login from an unexpected IP, country, or device in your identity platform’s sign-in logs. Without someone reviewing those logs – or a detection system alerting on anomalies – the intrusion goes unnoticed. Log review and identity threat detection is where the gap between managed security and break-fix IT support becomes operationally significant. Learn more about how Xact IT approaches layered security for small businesses on our cybersecurity services page.
What to Ask Your IT Firm Right Now
The most important shift you can make is moving from “do we have MFA?” to “how would our MFA hold up against a real-time proxy or a push bombing campaign?” Those are different questions, and only the second one matters in 2025.
Put these questions to your current IT provider:
- Are any users – especially in finance, executive, or IT administrator roles – still using SMS or time-based one-time password codes as their only second factor?
- Have we enabled number matching on every push-notification MFA deployment across the organization?
- Do we have conditional access policies that block authentication from an unrecognized device or unexpected geography?
- Who is reviewing our identity platform sign-in logs, how often, and what triggers an alert?
- What’s the plan to migrate our highest-risk accounts to phishing-resistant authentication methods such as hardware security keys or passkeys?
- Has employee training been updated in the last 12 months to include the specific behavioral response to unsolicited push notifications?
If the answer to any of these is “we haven’t looked at that” or “I’m not sure,” the gap is real – regardless of whether you’ve technically “enabled MFA.” The presence of a control and the effectiveness of a control are no longer the same statement when it comes to authentication. For a deeper look at how a managed security partner closes these gaps, explore our managed IT services.
The businesses that stay off the IC3 statistics in 2025 and 2026 aren’t necessarily the ones with the largest security budgets. They’re the ones asking sharper questions of the people responsible for protecting them – and getting specific, honest answers. MFA bypass attacks weren’t on most small business radar screens three years ago. They’re the dominant credential threat vector today. MFA was never a destination. It was always one layer – and the threat actors who specialize in dismantling it have made that clearer than any vendor ever did.
If you want a direct conversation about where your authentication posture actually stands, Book a Free Cybersecurity Strategy Call. No pressure, no obligation – just a straight answer from a team that’s kept clients breach-free for 20 years.
Frustrated With Your Current IT Provider?
If your current MSP isn’t catching the things this post describes, that’s a signal worth acting on. Book a strategy call and we’ll walk through what an honest IT partnership looks like for a business your size.