Free tools Windows power users keep installed
One-click scans. No signup required.
iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Phishing kits can get around multi-factor authentication (MFA) in two main ways: they can relay a live sign-in and steal the authenticated session created after the MFA check, or they can trick people and account-recovery workflows into handing over credentials or adding an attacker-controlled authenticator. In the first case, a victim may enter a correct MFA code and still lose control of the resulting session. This does not necessarily mean MFA itself was broken; the attacker may have abused the sign-in process or the session that followed it.
What “bypassing MFA” can mean
MFA adds a second proof of identity to a sign-in, such as a code, approval, security key, or passkey. But authentication and an authenticated session are not the same thing. After a service accepts a sign-in, it typically provides the browser with session material—often a cookie or token—that lets the user continue without proving identity again on every page. If an attacker obtains that post-login session, the attacker may be able to use it as the already-authenticated user.
That distinction explains why an MFA prompt can be completed successfully while an account is still compromised. Some attacks intercept the live sign-in and capture the resulting session. Others persuade a person or support process to reveal credentials, approve a request, reset a password, or enroll a new authenticator. The term “MFA bypass” can describe either outcome, but it should not be taken to mean that every case exploited a flaw in an MFA product.
How an AiTM reverse-proxy phishing kit steals a session
An adversary-in-the-middle (AiTM) reverse proxy places an attacker-controlled website between a person and the legitimate sign-in service. Instead of simply collecting a password on a fake page, the site relays the interaction to the real service and passes pages and responses back and forth. Mandiant’s March 17, 2025 article, “BitM Up! Session Stealing in Seconds Using the Browser-in-the-Middle Technique,” describes this session-stealing model.
#1 Best Overall
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
- The victim opens a phishing link. The link leads to an attacker-controlled domain that may be styled to resemble an employer, cloud service, or other familiar sign-in page. The browser is communicating with the phishing site, even if the pages it displays are being relayed from the real service.
- The kit relays the sign-in. The intermediary forwards the victim’s requests to the legitimate identity provider and returns the provider’s responses. It can modify references in the pages so the interaction continues through the intermediary.
- The victim enters credentials. The real service receives the username and password through the relay. Because the attacker is handling the live exchange, the kit can capture the credentials as they are submitted.
- The victim completes the real MFA challenge. The request is passed to the legitimate service, which may prompt for a one-time code, an approval, or another supported second factor. The user’s action can satisfy the real challenge; it is not necessarily a fake prompt.
- The service creates an authenticated session. After successful authentication, the identity provider returns session material to the browser. The relay can capture that material as part of the exchange.
- The attacker attempts to use the session. The attacker can present the stolen session material to access the service as the authenticated user. If the service accepts it, the attacker may not need to complete the MFA challenge again for that session.
Mandiant summarizes the impact this way: “Stealing this session token is the equivalent of stealing the authenticated session, meaning an adversary would no longer need to perform the MFA challenge.” That does not mean the attacker can use every session indefinitely or from every device. A session can expire, be revoked, or be subject to additional checks, depending on the identity provider and application. The important point is that MFA may already have done its job at sign-in; the stolen session is a separate credential-like asset.
A convincing page or familiar-looking logo is not proof that the browser is connected directly to the expected service. The domain in the address bar matters, but a user can miss a lookalike or unfamiliar domain, especially when arriving through a link. Organizations should not make users responsible for detecting every sophisticated relay; stronger authenticators and session protections reduce the opportunity for a stolen sign-in to become lasting access.
How browser-in-the-middle attacks differ
Browser-in-the-middle (BitM) attacks also expose an authenticated session, but they use a different arrangement from a transparent reverse proxy. The victim interacts with a browser controlled by the attacker. The sign-in and MFA activity take place in that attacker-controlled browser environment, leaving the resulting authenticated state accessible to the operator.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Clear out junk files and repair common Windows errors3Fix the driver behind crashes, sound loss and screen glitchesRank #2
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Mandiant says this approach can make it easier to target a range of websites than configuring traditional transparent proxies for each application. The practical lesson is that a user may be looking at a working, genuine service inside an attacker-operated environment; seeing a legitimate page or completing a legitimate challenge does not establish who controls the browser behind it.
Mandiant identifies FIDO2 authentication and client certificates as defenses against this technique because they bind authentication to the legitimate site or a device credential. That protection is not a cure for a compromised device: if malware or an attacker controls the victim’s own device, origin binding alone cannot make that endpoint trustworthy.
How attackers use people and account workflows
Not every campaign needs to intercept a session token. A phishing page can harvest credentials, while a caller or message can pressure a person to provide a code, approve a prompt, or follow instructions for an alleged security update. Attackers may then use password reset, support, or MFA-enrollment procedures to establish access of their own.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
In a January 30, 2026 report, Mandiant described campaigns in which callers impersonated IT staff, claimed employees needed an MFA update, directed them to victim-branded credential-harvesting pages, captured single sign-on (SSO) credentials and codes, and enrolled attacker-controlled devices. Mandiant explicitly attributed the activity to social engineering rather than a vendor-product vulnerability. The distinction matters: improving an authenticator helps, but it does not replace controls on who can change account credentials or add a new factor.
- Vishing: A phone caller impersonates support or IT and creates urgency around an account or MFA change.
- Credential harvesting: A branded sign-in page collects passwords and may also relay or solicit MFA information.
- Unauthorized enrollment: The attacker persuades the user or support staff to add a device or authenticator controlled by the attacker.
- Recovery abuse: A password reset or account-recovery process is manipulated to regain or establish access.
These approaches can be combined. For example, stolen credentials may help an attacker make a plausible help-desk request, and a successful enrollment change may provide access even after a password is changed. Treat unexpected requests to register a new factor, approve a sign-in, or disclose a code as identity changes that require independent verification—not as routine housekeeping.
What different MFA and account controls protect against
No single control addresses every part of the attack. The comparison below separates protection at authentication from protection after sign-in and from the account-management practices that govern enrollment and recovery. The sources support these distinctions, but do not provide a controlled product-by-product test or a universal ranking.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
| Control or approach | Origin binding | What it changes in these attacks | Remaining considerations |
|---|---|---|---|
| FIDO2 security key or passkey, where supported | WebAuthn authentication is bound to the legitimate origin. | Google Cloud’s campaign guidance says this makes lookalike domains and AiTM proxies ineffective against those authenticators; Mandiant describes hardware-based FIDO2 as strong protection against BitM. | Support depends on the identity provider, account, and device. Enrollment and recovery still need protection, and a compromised endpoint remains a risk. |
| Other MFA methods | The reviewed sources do not establish phishing-resistant origin binding for every method. | A live relay or social engineering may capture credentials and codes or induce an approval, depending on the service and the method in use. | Do not infer that every method behaves identically. Use phishing-resistant authentication where supported and add session and enrollment controls. |
| Session and device controls | Not an authenticator; these govern use of an already-created session and the context in which access is allowed. | Shorter session lifetimes, idle timeouts, step-up checks, device-bound session protections, and managed-device restrictions can reduce the usefulness of stolen sessions or limit access. | Availability and exact behavior depend on the identity and SaaS platforms. They do not prevent every credential theft or social-engineering attempt. |
| Enrollment, reset, and recovery controls | Not an authenticator; these govern changes to identity proof and account access. | Restricting who can reset passwords or add factors makes it harder to turn persuasion or a stolen credential into durable access. | Help-desk verification must be independent and consistent; a familiar-sounding caller is not sufficient evidence of identity. |
How to reduce the chance of an MFA-related compromise
Prefer phishing-resistant authentication
Use FIDO2 security keys or passkeys for accounts and services that support them. Google Cloud’s campaign guidance explains that WebAuthn origin binding prevents a lookalike domain or AiTM proxy from successfully using those authenticators as though it were the legitimate service. Mandiant also recommends FIDO2 keys or passkeys in enterprise hardening guidance. Check compatibility with the organization’s identity provider, account, and devices before standardizing on a particular option; the cited guidance supports the category, not a specific make or model.
Put controls around enrollment and recovery
Limit which staff and systems can reset passwords or enroll and modify MFA methods. Require high-assurance verification for sensitive identity changes, using known-good callback numbers and manager confirmation where appropriate, rather than numbers or contact details supplied in an unexpected request. During active containment, Mandiant advises temporarily pausing new MFA enrollment so an attacker cannot quietly add another factor while the incident is being investigated.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Make sessions less valuable to an attacker
Where the platform supports them, set session lifetimes and idle timeouts to fit the sensitivity of the application, require step-up authentication for sensitive actions, and use device-bound session protections. Managed-device restrictions and trusted network sources can further narrow the contexts in which accounts can be used. Google Cloud’s 2026 guidance recommends session controls, managed-device restrictions, trusted network sources, and monitoring MFA-registration events. These are platform-dependent features, not settings that every organization will find under the same name or have available on every service.
Best Value
- FIDO2 & Passkey Ready: Business-ready and FIDO2 L1 certified. This key is supported by major management suites and is ideal for both individual and enterprise deployment. Works seamlessly with Gmail, Facebook, GitHub, Dropbox, Coinbase, and more.
- Universal Connectivity (USB-A ): Features a built-in USB-A connector—simply unfold the key and plug it into your compatible PC or laptop for seamless authentication on the go.
- Dedicated Manager App: Use the Thetis Manager App for the initial hardware PIN setup. Setting the PIN on the device first ensures a smooth registration process. Once the PIN is configured, you can begin registering the key across your favorite FIDO2-compatible online services.
- Ultra-Durable & Portable: Featuring a rotating metal cover, this key is water, crush, and tamper-resistant. It fits easily on a keychain and requires no batteries or network connectivity.
- Check FIDO2 compatibility before purchase - Known limitations: ID Austria is not supported (requires FIDO2 Level 2). Windows Hello login only works with Windows Enterprise editions that support Entra ID, and NFC is NOT supported.
Watch for identity changes and unusual access
Monitor identity-provider and SaaS audit events for MFA registrations, password resets, unfamiliar devices, unexpected sign-ins, and activity that does not fit normal account use. Monitoring should be paired with an owner and a response path: an alert that nobody reviews will not contain a stolen session. Review access to connected SaaS applications as well as the central identity account, because an attacker may have used the initial sign-in to authorize or access other services.
What to do if you suspect a session or account was stolen
Act quickly, and do not treat a password change as a complete response. If an attacker has a live session or has added an authenticator, changing the password alone may leave active access or persistence in place. The precise controls differ by identity provider and SaaS platform, so involve the organization’s identity or security team when available.
- Contain the account. Disable or otherwise contain affected accounts while assessing the risk. Restrict remote access from untrusted or non-compliant devices where those controls exist.
- Revoke access already issued. Revoke active sessions and OAuth authorizations across the identity provider and affected SaaS systems. Check that the relevant applications are included rather than assuming one central sign-out invalidates every downstream session.
- Protect recovery and enrollment. Restrict password resets and new MFA enrollment while investigating. Review recent authenticator additions and account changes, and remove unauthorized methods through a verified administrative process.
- Review logs and activity. Examine identity-provider and SaaS audit events for sign-ins, MFA-registration changes, resets, authorizations, and actions taken after the suspected compromise. Look for attacker-created persistence as well as the initial entry point.
- Restore access through a verified process. Reset credentials and re-establish authenticators only after confirming the user’s identity through trusted procedures and securing the device used for recovery.
- Continue checking for residual access. Confirm that sessions and authorizations have been invalidated, inspect for remaining unauthorized changes, and keep monitoring for renewed access attempts.
Mandiant’s January 2026 guidance recommends containing affected accounts, revoking sessions and OAuth authorizations, restricting resets and enrollment during investigation, reviewing identity and SaaS events, and restoring credentials and authenticators through a verified process. The sequence matters: recovery that begins before containment can give an attacker another opportunity to retain or regain access.
What the evidence does—and does not—establish
The cited Mandiant and Google Cloud material documents concrete mechanisms and defensive practices, but it does not quantify how often phishing kits successfully bypass MFA across all users or services. It also does not provide a universal comparison test for authenticator products or confirm compatibility for a particular security-key model. Treat the techniques as credible attack paths to design against, not as a measured estimate of every organization’s likelihood of compromise.
The central security principle is to protect both the sign-in and what comes after it. Phishing-resistant authentication can stop important forms of credential relay, while short-lived or device-aware sessions, monitored identity changes, and carefully verified recovery can reduce the damage when a person or session is targeted.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
