How Credential Leaks Bypass Multi-Factor Authentication

Introduction

In September 2024, a mid-sized healthcare provider faced a credential-stuffing attack that compromised 12,000 patient records. The organisation had multi-factor authentication (MFA) deployed across all critical systems. The attackers never needed to bypass the MFA prompt itself. They used credential leak detection to identify session tokens and API keys exposed in infostealer logs on Telegram channels — tokens that allowed them to authenticate directly as already-verified users. MFA never triggered because the session was already valid.

This article explains the specific mechanisms by which leaked credentials render MFA ineffective. It is written for CISOs, SOC analysts, and identity security teams who have invested in MFA but remain vulnerable to account takeover. It answers the question: if credentials are the new perimeter, what happens when that perimeter is already breached before MFA even sees the attacker?

How Leaked Credentials Bypass MFA: The Core Mechanisms

Multi-factor authentication was designed to prevent account takeover when a password is compromised. But modern credential theft has evolved past the password-prompt stage. Attackers now steal the tokens, cookies, and session data that MFA-protected systems accept as proof of prior authentication. When credential leak detection fails to catch these signals in time, the attacker gains persistent access without ever triggering an MFA challenge.

What Specific Types of Leaked Data Bypass MFA?

Credentials that bypass MFA are not limited to username-password combinations. The most dangerous exposures include session cookies, OAuth tokens, API keys, and browser-stored authentication artefacts that attackers use to impersonate a user who has already completed MFA.

• Session cookies and authentication tokens: Infostealer malware such as RedLine Stealer, Vidar, and Lumma Stealer extracts browser-stored session cookies for services including Okta, Microsoft 365, AWS, and Google Workspace. These cookies allow attackers to resume authenticated sessions without re-entering credentials or completing MFA.
• OAuth2 and SAML assertion tokens: Attackers who compromise a machine with stealer malware can extract OAuth refresh tokens or SAML assertions stored in local application data. These tokens grant persistent API-level access that bypasses both passwords and MFA prompts.
• Pre-authenticated session keys: Some enterprise applications store session keys in local storage or configuration files after a user completes MFA. If these keys are exfiltrated via infostealer logs, attackers can replay them to gain authenticated access directly.
• API keys and service account credentials: Hardcoded or poorly secured API keys in configuration files, CI/CD pipelines, or code repositories often lack MFA enforcement entirely. Compromised service account credentials give attackers lateral movement capabilities without triggering any user-facing authentication challenge.

The SpyCloud Annual Identity Exposure Report 2024 found that 64% of all exposed credentials in infostealer logs were accompanied by valid session cookies or authentication tokens, making MFA bypass possible for the majority of compromised accounts.

The Role of Infostealer Logs in MFA Circumvention

Infostealer malware is the primary mechanism by which attackers collect the authentication artefacts that bypass MFA. These malware families operate by infecting endpoints through phishing, drive-by downloads, or fake software installers, then exfiltrating browser databases, credential stores, and local application data. The exfiltrated data is packaged into logs and sold on dark web credential markets including Russian Market, 2easy Market, and Telegram channels dedicated to stealer log trading.

How Do Infostealer Logs Enable MFA Bypass?

Infostealer logs contain far more than passwords. Modern stealer malware extracts the complete browser profile, including session cookies, saved credentials, autofill data, and browser-stored authentication tokens. When attackers replay these artefacts on their own machines, the target application recognizes the session as already authenticated — meaning the MFA challenge was completed on the victim's machine, not the attacker's.

• RedLine Stealer: Extracts browser cookies, stored credentials, and cryptocurrency wallet data. RedLine logs are commonly found on XSS.is and Exploit.in forums, often bundled with session cookie databases for Microsoft 365 and Google Workspace.
• Lumma Stealer: Targets browser-stored authentication tokens for cloud applications, including AWS Console, Azure Portal, and Okta. Lumma logs are sold on Telegram channels with session-specific metadata that attackers use to prioritize high-value accounts.
• Raccoon Stealer: Exfiltrates browser autofill data and stored passwords, but critically also collects browser extension data — including MFA token-generating extensions. This gives attackers insight into which accounts are MFA-protected and which tokens are currently valid.
• Vidar: Extracts session cookies, browser credentials, and VPN configuration files. Vidar logs are often sold alongside system fingerprints that attackers use to session-replay without triggering geographic or device-based MFA anomalies.

MITRE ATT&CK Technique T1539 (Steal Web Session Cookie) categorizes this specific attack vector — the adversary captures session cookies via browser process injection or direct file theft, enabling reuse against web applications that trust the cookie as proof of prior authentication.

Combo Lists, Credential Stuffing, and MFA Fatigue Attacks

Even when attackers lack session tokens, leaked credentials from combo lists can still circumvent MFA through targeted attack sequences. Combo lists — compiled databases of username-password pairs aggregated from multiple breaches and stealer logs — enable credential-stuffing attacks at scale. But the real MFA bypass occurs after the initial password-based login succeeds.

What Is the Difference Between Session Replay and MFA Fatigue?

Session replay uses already-authenticated tokens to bypass MFA entirely. MFA fatigue attacks, by contrast, target users who have valid passwords but are protected by MFA — the attacker repeatedly pushes MFA prompts to the user's device until the user approves out of frustration or confusion. Both methods rely on leaked credentials as the entry point, but session replay is more dangerous because MFA never activates.

• Credential stuffing with MFA fatigue: Attackers use combo list credentials to attempt login. When MFA triggers, they send push notifications in rapid succession — sometimes dozens per minute — until the user approves. This technique was used by Scattered Spider (UNC3944) against MFA-protected Okta environments in 2023 and 2024.
• SIM swapping combined with leaked credentials: Attackers who obtain credentials from combo lists can initiate SIM-swap attacks to intercept SMS-based MFA codes. The leaked password provides the account access; the SIM swap provides the second factor.
• MFA bypass via backup codes: Many MFA systems provide backup codes for account recovery. These codes are often stored in browser credential managers or locally saved documents. Infostealer logs frequently contain backup code files, giving attackers a permanent MFA bypass without user interaction.

Initial Access Brokers: Monetising MFA-Bypass Capabilities

The dark web marketplace for initial access operates on the premise that leaked credentials — whether simple passwords or full session-bearing infostealer logs — provide direct paths into corporate networks. Initial access brokers (IABs) specialize in validating and selling these access vectors, often explicitly advertising MFA-bypass capabilities.

How Do Initial Access Brokers Bypass MFA at Scale?

IABs operate on forums including RAMP, Exploit.in, and the successor communities to BreachForums. They purchase raw infostealer logs, validate the session cookies or tokens against live targets, and resell access as a validated foothold. The buyer receives a working authenticated session without ever needing to attempt a password login or MFA challenge.

• Validated session cookie access: IABs test extracted cookies against the target domain. If the cookie is still valid, the access is sold at a premium — often five to ten times the price of a raw credential pair — because the buyer can bypass all authentication controls immediately.
• Geographic and device fingerprint matching: Advanced IABs use stolen browser fingerprints to replay sessions from IP addresses and device configurations that match the original victim. This avoids triggering location-based MFA policies or device-trust checks.
• Targeted credential monitoring: IABs scan infostealer logs for credentials belonging to specific organizations — particularly financial services, healthcare, and technology companies — and prioritize logs that contain session tokens for those targets.

The Verizon 2024 Data Breach Investigations Report notes that 68% of data breaches involved a non-malicious human element, often a user falling victim to social engineering that led to credential theft — reinforcing that MFA alone cannot prevent access when the user's session is compromised after authentication.

Real-World Incidents: MFA Bypass via Leaked Credentials

Understanding how credential leaks bypass MFA requires examining incidents where organisations had MFA deployed but were still compromised through credential exposure. These cases demonstrate that detection of leaked credentials — before they are weaponized — is the critical missing control.

Case Study: Microsoft 365 Session Cookie Theft via RedLine Stealer

In early 2024, a manufacturing company with fully deployed MFA on all Microsoft 365 accounts suffered a business email compromise that led to a $1.2 million wire fraud loss. Forensic analysis revealed that an employee had downloaded fake software containing RedLine Stealer. The malware exfiltrated browser cookies for Microsoft 365. Attackers replayed these cookies on their own devices, accessing email and cloud storage without any MFA prompt. The MFA system never registered a failed authentication or an anomalous login because the session token was issued to the legitimate user on a trusted device.

Case Study: Okta MFA Fatigue Attack via Combo List Credentials

A healthcare IT services firm experienced account takeover when attackers used credentials from a known combo list to attempt login to their Okta environment. The login triggered Okta Verify push notifications to the user's phone. The attacker sent 27 push requests in a four-minute window. The user, believing it was a system error, approved one request. The attacker then accessed the Okta admin console, created a backdoor service account, and maintained access for 18 days before being detected. Post-incident analysis showed the credentials had been exposed in a third-party breach eight months prior.

Case Study: AWS API Key Exposure via Lumma Stealer Logs

A fintech startup had MFA enforced on all user-facing accounts but had not applied MFA to programmatic access via API keys. Lumma Stealer logs containing an AWS IAM user's access key and secret key were sold on Russian Market. The buyer used these keys to provision cryptocurrency mining instances, generating over $90,000 in cloud costs before the organization detected the anomalous compute usage. The API keys had been stored in a local configuration file that the malware exfiltrated as part of its browser-data sweep.

The Credential Leak Detection Gap: Why MFA Alone Is Insufficient

MFA remains an essential security control, but it was designed for a threat model where the password is the only credential attackers possess. The modern credential theft ecosystem has expanded the attack surface to include session tokens, API keys, OAuth grants, and backup codes — none of which are protected by MFA prompts because they are authentication artefacts, not authentication challenges.

What Credential Leak Detection Controls Address This Gap?

Effective credential leak detection extends beyond password monitoring to include the full spectrum of authentication artefacts that attackers use to bypass MFA. Organizations that monitor only username-password combinations in breach databases miss the session-bearing infostealer logs that represent the highest risk of MFA bypass.

• Infostealer log monitoring: Continuous scanning of dark web forums, Telegram channels, and credential markets for logs containing session cookies, authentication tokens, and API keys associated with the organization's domains.
• Session token revocation workflows: Automated processes to invalidate all active sessions when credential exposure is detected, forcing re-authentication and blocking session replay attacks.
• Credential alerting with severity scoring: Risk-based prioritization that distinguishes between password-only exposures and log-bearing exposures, enabling faster response to the most dangerous MFA-bypass scenarios.
• Domain-wide exposure monitoring: Monitoring all corporate domains, subdomains, and associated services — including SaaS applications, cloud infrastructure, and development environments — for leaked authentication artefacts.

How DarkThreat.AI Addresses MFA-Bypass Credential Leaks

DarkThreat.AI's credential leak detection capabilities are built on the understanding that MFA-bypass data lives in highly transient dark web sources — Telegram channels where stealer logs are posted minutes after exfiltration, invite-only credential markets where session-bearing logs are validated and sold, and IAB listings where access is pre-verified. Our platform ingests and indexes these sources in real time, searching for session cookies, authentication tokens, and API keys alongside traditional credentials.

When DarkThreat.AI detects an infostealer log containing a valid session cookie for a monitored domain, the platform generates a severity-scored alert that includes the specific token type, the malware family that exfiltrated it, and the dark web source where it was published. This enables security teams to revoke the affected session, force password rotation, and investigate the infected endpoint before the session token is weaponized — all within minutes of exposure, not days or weeks after the attack has succeeded.

Related Resources

• What Is Credential Leak Detection? — Foundational overview of credential exposure monitoring and why it differs from traditional breach notification services.
• Infostealer Logs Explained — Deep dive into how stealer malware exfiltrates authentication data and how to detect logs targeting your organization.
• Leaked Credentials and Initial Access: MITRE ATT&CK Mapping — Technical mapping of credential leak vectors to MITRE ATT&CK techniques, including session cookie theft and token reuse.
• Stealer Logs and Dark Web Monitoring: The Connection — How real-time dark web monitoring detects stealer logs before they are used in attacks.

Conclusion

Multi-factor authentication is not broken — but the threat model it was designed to address has fundamentally changed. Attackers no longer need to defeat the MFA prompt when they can steal the session artefacts that bypass it entirely. Credential leak detection that includes infostealer log monitoring, session token detection, and real-time alerting is the only control that addresses this gap. Organisations must treat session cookies and authentication tokens as credentials worthy of the same protection and monitoring as passwords.

The credential theft ecosystem is moving faster than most security teams can react. Infostealer malware families are growing more sophisticated, initial access brokers are professionalizing session validation, and dark web credential markets are becoming more efficient at connecting buyers with MFA-bypass data. Credential leak detection — specifically, detection that captures session-bearing artefacts — is the intelligence layer that closes the gap between MFA deployment and real-world account takeover protection. Without it, MFA is a control that only works against the attacks of the past.