The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Phishing kits can get around multi-factor authentication (MFA) in two broad ways: they can relay a real sign-in and steal the authenticated session it creates, or they can trick people into handing over credentials and approving account changes such as enrolling an attacker-controlled authenticator. In either case, completing an MFA prompt does not prove that the session or account is safe afterward.
What an MFA bypass means—and what it does not
MFA adds a second check to sign-in, such as a one-time code, an approval prompt, or a security key. It makes a stolen password less useful by itself. But a login also creates an authenticated session: the identity service may issue a session cookie or other token that tells the service the user has already signed in. If an attacker obtains that session material, the attacker may be able to use the signed-in session without presenting the password or repeating the MFA challenge for that session.
As an Amazon Associate I earn from qualifying purchases.
That distinction matters. In the attacks described by Mandiant and Google Cloud, the weakness is not necessarily a flaw in the MFA product. A reverse proxy can relay a legitimate sign-in, while vishing and fake help-desk requests exploit trust in people and account-recovery workflows. Treat “MFA bypass” as a description of the outcome, not proof that an authenticator has been technically broken.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →The available campaign reports explain how these methods work, but do not establish how often phishing kits successfully defeat MFA across all users or services. Outcomes depend on the sign-in flow, the authenticator, session settings, device controls, and the organization’s enrollment and recovery procedures.
#1 Best Overall
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
How an AiTM phishing kit steals a live sign-in
The reverse-proxy relay
An adversary-in-the-middle (AiTM) reverse proxy sits between the victim and the real sign-in service. The victim follows a phishing link to an attacker-controlled page. That server forwards the victim’s requests to the real service and relays the service’s responses back, adapting links or references so the interaction continues through the phishing domain. To the victim, the page can look and behave like a normal sign-in.
- The victim opens the phishing page. The page acts as an intermediary rather than simply storing a fake login form.
- The victim enters a username and password. The proxy can relay those credentials to the real identity provider as the victim types or submits them.
- The real service requests MFA. The victim completes the genuine challenge through the relayed flow. The challenge may be a code or another supported method; the attacker does not have to forge the identity provider’s response.
- The real service authenticates the user. After successful authentication, it returns session material, such as a session cookie, through the intermediary.
- The proxy captures the authenticated session. The attacker may then replay or otherwise use the stolen session material, subject to the service’s protections and session conditions.
Mandiant’s March 17, 2025 article, “BitM Up! Session Stealing in Seconds Using the Browser-in-the-Middle Technique,” explains the consequence directly: “Stealing this session token is the equivalent of stealing the authenticated session, meaning an adversary would no longer need to perform the MFA challenge.” This is why entering a correct MFA code is not, by itself, a guarantee that the resulting session belongs only to the legitimate user.
Why the session can outlast the MFA prompt
MFA usually verifies an authentication event; it does not necessarily require the user to repeat the challenge for every page or action afterward. A session token represents the authenticated state granted by the service. If the attacker can reuse a valid token, the service may treat the attacker’s request as coming from an already signed-in session rather than as a new login. The stolen session’s usefulness depends on factors such as expiration, revocation, device or context checks, and whether the service requires step-up verification for sensitive actions.
Recommended Free Tools
Rank #2
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Changing the password can stop future sign-ins with the old password, but it may not automatically invalidate every session already issued or every authorization connected to the account. That is why response needs to address active sessions and connected app authorizations as well as the password.
How browser-in-the-middle attacks differ
Browser-in-the-middle (BitM) attacks also expose an authenticated session, but the mechanism differs from a transparent reverse proxy. Instead of relaying the victim’s browser requests through a proxy configured for a particular site, the attacker provides or controls the browser in which the victim interacts. The victim’s sign-in, MFA steps, and subsequent activity occur in that attacker-controlled browser environment. The operator can access the resulting authenticated state and may observe activity within the session.
Mandiant says this approach can make it easier to target a wider range of websites than configuring traditional transparent proxies for each application. It is still not a universal bypass: the account, service, device, and authentication method affect whether the attempt succeeds. Mandiant identifies FIDO2 authentication and client certificates as defenses because they bind authentication to the legitimate site or a device credential. Those protections do not secure a device that has itself been compromised.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
| Attack path | What the victim interacts with | What the attacker seeks | Key distinction |
|---|---|---|---|
| AiTM reverse proxy | A phishing page relaying a real sign-in service | Credentials and session material returned after authentication | The proxy forwards and adapts traffic between the victim and the legitimate service. |
| Browser-in-the-middle | A browser controlled by the attacker | The authenticated browser state and potentially activity in that session | The victim’s interaction takes place in the attacker’s browser environment. |
| Vishing or account-process manipulation | A caller, fake help desk, credential page, or recovery workflow | Credentials, MFA codes or approvals, password resets, or unauthorized authenticator enrollment | The attack targets people and identity processes rather than relying only on token interception. |
How social engineering gets around MFA protections
Not every campaign needs to intercept a session token. Mandiant’s January 30, 2026 guidance on ShinyHunters-branded SaaS data theft describes callers impersonating IT staff and claiming that an MFA update is needed. The callers directed employees to credential-harvesting pages branded to resemble the victim organization, captured single sign-on credentials and codes, and enrolled attacker-controlled devices. Mandiant explicitly characterized the activity as social engineering, not a vendor-product vulnerability.
Other related routes include fake help-desk requests, pressure to approve an unexpected prompt, stolen credentials used to initiate a password reset, and attempts to add an attacker’s authenticator during a legitimate-looking support interaction. These approaches can be combined: a phished password may let an attacker start a real login, while a convincing caller persuades the victim to disclose a code or approve enrollment.
- Unexpected MFA request: Do not approve a sign-in you did not initiate, even if a caller says the approval is routine or urgent.
- Request for a code: Treat a one-time code as a credential. A legitimate support representative should not need you to read a sign-in code back to them.
- New authenticator or recovery change: Verify the request through a known, independently obtained support channel before enrolling a device or changing recovery details.
- Urgency or threat: A claim that access will be lost unless you act immediately is a reason to pause and verify, not to bypass normal checks.
Which authentication choices resist phishing best?
For supported services, FIDO2 security keys and passkeys are strong choices because they use origin-bound authentication: the credential is tied to the legitimate site rather than simply supplying a code that can be relayed from a lookalike page. Google Cloud’s campaign guidance says WebAuthn origin binding makes lookalike domains and AiTM proxies ineffective against those authenticators. Mandiant also recommends FIDO2 keys or passkeys and describes hardware-based FIDO2 as strong protection against BitM.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Protection is not only about the authenticator. A strong sign-in method can still be undermined if an attacker can persuade support to reset the account, enroll a new method, or restore access using weak verification. Session lifetime and device controls also affect the value of a stolen session.
| Control or authentication choice | What the reviewed guidance establishes | What it does not establish |
|---|---|---|
| FIDO2 security key or passkey | Phishing-resistant option where supported; origin binding helps defeat lookalike domains and AiTM proxies. | Compatibility with a particular account, identity provider, device, or key model; protection for a compromised endpoint. |
| Code or approval used in a relayed sign-in | Mandiant documented campaigns capturing credentials and codes through social engineering; a relayed real sign-in can result in stolen session material. | A universal success rate or a product-by-product comparison of MFA methods. |
| Session and device controls | Shorter session lifetimes, idle timeouts, step-up authentication, device-bound protections, managed-device restrictions, and trusted network sources can reduce session value or access opportunities where supported. | That every identity provider or SaaS service offers the same settings or that any one setting blocks every attack. |
| Enrollment, reset, and recovery checks | Restrict sensitive changes, use trusted devices or locations, and apply high-assurance help-desk verification; Mandiant recommends known-good callback numbers and manager confirmation for sensitive resets. | A universal recovery workflow suitable for every organization. |
There is no universal product ranking supported by these campaign reports. The practical comparison is whether the method binds authentication to the real origin, how a stolen post-login session is handled, whether access is constrained to trusted devices or contexts, and how rigorously new authenticators and account recovery are verified. If buying a physical key, confirm compatibility with the specific account, identity provider, and devices before choosing a model; the available guidance supports the hardware-key category, not a particular make or model.
How to reduce the chance that a stolen login becomes an account takeover
Choose phishing-resistant sign-in where available
Enable a FIDO2-compatible security key or passkey for accounts and services that support it. Prefer this for administrators and other high-impact accounts when the organization’s identity platform permits it. Keep the enrollment path protected: a phishing-resistant login does not help if an attacker can add a replacement authenticator through an unverified reset process.
Best Value
- FIDO2 & Passkey Ready: Business-ready and FIDO2 L1 certified. This key is supported by major management suites and is ideal for both individual and enterprise deployment. Works seamlessly with Gmail, Facebook, GitHub, Dropbox, Coinbase, and more.
- Universal Connectivity (USB-A ): Features a built-in USB-A connector—simply unfold the key and plug it into your compatible PC or laptop for seamless authentication on the go.
- Dedicated Manager App: Use the Thetis Manager App for the initial hardware PIN setup. Setting the PIN on the device first ensures a smooth registration process. Once the PIN is configured, you can begin registering the key across your favorite FIDO2-compatible online services.
- Ultra-Durable & Portable: Featuring a rotating metal cover, this key is water, crush, and tamper-resistant. It fits easily on a keychain and requires no batteries or network connectivity.
- Check FIDO2 compatibility before purchase - Known limitations: ID Austria is not supported (requires FIDO2 Level 2). Windows Hello login only works with Windows Enterprise editions that support Entra ID, and NFC is NOT supported.
Protect enrollment, reset, and recovery
- Limit which staff or roles can reset passwords, enroll MFA methods, or alter recovery information.
- Require a high-assurance verification process for sensitive changes. Mandiant recommends contacting a known-good callback number and obtaining manager confirmation for sensitive resets.
- Use trusted devices and locations for identity changes where the platform supports those restrictions.
- Alert on new MFA registrations and unexpected changes to authenticators, recovery details, or account access.
- During active containment, consider temporarily pausing new MFA enrollment while investigating, as Mandiant advises.
Make sessions harder to reuse
Where the identity and SaaS platforms offer them, use shorter session lifetimes and idle timeouts, require step-up authentication for sensitive actions, and apply device-bound session protections. Restrict access to managed devices or trusted network sources when appropriate. Monitor unusual identity-provider events and MFA-registration activity. These controls can reduce the usefulness of a captured session or help surface suspicious activity sooner, but their availability and exact behavior vary by platform.
Give people a verification route that does not come from the caller
Teach employees to end an unexpected support call and contact the help desk through a known directory number or internal channel. A caller’s number, email signature, or link is not independent verification when the caller may be impersonating IT. Explain that staff should not share a code, approve an unrequested sign-in, or enroll a device because a caller claims an update is required.
What to do if a phishing link or MFA prompt may have compromised an account
Act promptly. If a user entered credentials into a suspected phishing page, approved an unexpected prompt, or enrolled a device at someone else’s request, report it through the organization’s incident channel or the service’s official recovery process. Do not assume that changing the password alone ends an attacker’s access.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
- Contain the account. Disable or otherwise contain affected accounts as appropriate to the organization’s response process, particularly accounts with elevated access.
- Revoke sessions and authorizations. Invalidate active sessions and revoke OAuth authorizations across identity and SaaS systems. A password change does not necessarily remove previously issued sessions or app permissions.
- Pause risky account changes. Restrict password resets and new MFA enrollment while the incident is under investigation, so an attacker cannot use the recovery path to regain access.
- Limit access from untrusted endpoints. Restrict remote access from non-compliant or untrusted devices while determining whether a device or session is compromised.
- Review audit events. Check identity-provider and SaaS logs for unusual sign-ins, MFA registrations, resets, consent or authorization changes, and activity that continued after the suspected exposure.
- Restore access through verified recovery. Reset credentials and re-establish authenticators using a trusted, independently verified process. Remove attacker-created methods or persistence before returning the account to normal use.
Mandiant’s 2026 guidance supports containment, broad session and OAuth revocation, tighter control of resets and MFA enrollment, audit-log review, and verified restoration. The exact controls depend on the organization’s identity and SaaS platforms; response teams should apply the relevant administrative procedures rather than assume one console or setting covers every connected service.
What the campaign figures can—and cannot—tell you
Google Threat Intelligence Group’s 2026 report on UNC6671 describes an extortion operation and gives financial figures for that specific activity: 141.65 BTC received across 18 reviewed BlackFile wallet addresses between January 7 and May 12, 2026, valued at approximately $10.69 million at the time of those transactions. Initial ransom demands in the reported cases typically ranged from $1 million to more than $3 million; final payments averaged $750,000, approximately 10.2 BTC, in over 53% of the tracked cases during the report’s stated timeframe.
Those numbers describe the reported operation, not the prevalence of phishing kits, the rate at which MFA is bypassed, or the likelihood that a particular user will be targeted. The reports establish attack mechanics and defensive principles, not a universal success rate or a controlled comparison of authenticator products.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
