How MFA Bypass Techniques Exploit Leaked Credentials

Introduction

In 2024, a healthcare organization using hardware security keys for multi-factor authentication was breached. The attackers didn’t bypass the FIDO2 token—they tricked the help desk into resetting MFA enrollment on an account whose password had appeared in a stealer log three months prior. This is not a hypothetical scenario. MFA bypass techniques are evolving, and the common denominator in these attacks is almost always a leaked credential. When an employee’s password is exposed on a dark web credential market, MFA becomes a speed bump, not a wall.

This article explains how modern MFA bypass techniques exploit leaked credentials, including session theft, MFA fatigue bombardment, and adversary-in-the-middle phishing. It details the technical mechanisms behind each method, maps them to MITRE ATT&CK techniques, and provides actionable credential leak detection strategies that security teams must implement to neutralise these attacks before they begin. This is written for CISOs, SOC managers, identity security engineers, and IAM architects who need to understand why credential leak detection is the logical first step in preventing MFA bypass.

How Leaked Credentials Enable MFA Bypass

A common misconception is that a leaked password alone is insufficient if MFA is enabled. In reality, a leaked credential provides the attacker with the foundational element for almost every MFA bypass technique. Without a valid username and password combination acquired from an infostealer log, a combo list, or a credential market, the most sophisticated MFA bypass techniques are ineffective. The attacker needs something that already authenticates them partially within the system.

What Is the Relationship Between Leaked Credentials and MFA Bypass?

The relationship is direct and causal. Leaked credentials serve as the prerequisite authentication step that enables the attacker to trigger MFA challenges, manipulate MFA sessions, or phish MFA codes. Without a password or session token, an attacker cannot force an MFA prompt, cannot access the session to steal tokens, and cannot authenticate to an MFA-phishing page convincingly enough to harvest valid TOTP codes or push approvals.

• Triggering MFA Prompts Requires a Valid Password: Attackers use leaked passwords to log in to portals that enforce MFA. This generates push notifications, SMS codes, or authenticator prompts that they then exploit via fatigue bombing or social engineering.
• Session Token Theft Requires Pre-Authentication: Stealer malware that captures session cookies after MFA has been completed is valuable, but the attacker must first have the credential to log in and reach that post-MFA state. Leaked credentials are the entry point.
• Phishing MFA Codes Requires Credential Authenticity: Adversary-in-the-middle (AitM) phishing toolkits need the target to enter a valid username and password. The attacker provides the leaked credential to the phishing site, which passes it to the real identity provider, prompting a real MFA code that the target then enters into the phishing page.

Every one of these MFA bypass techniques is predicated on having a credential that is already exposed. Credential leak detection is not an alternative to MFA; it is the prerequisite security layer that prevents MFA from becoming an attack surface.

MFA Fatigue and Push Bombing: Overload the User

MFA fatigue, also known as push bombing or MFA spam, is one of the most effective MFA bypass techniques in current use. Notable incidents include the Uber breach in 2022 and the MGM Resorts ransomware attack in 2023, both linked to the Scattered Spider (UNC3944) threat actor group. In these attacks, the adversary already had the employee's password from a stealer log or combo list. They logged in repeatedly, triggering a barrage of push notifications to the employee’s mobile device.

How Does Push Bombing Exploit a Leaked Credential?

The attacker uses the leaked password to initiate authentication, which triggers an MFA push notification to the legitimate user’s device. The goal is to generate so many prompts that the user either accidentally approves one out of annoyance or consciously approves it believing the system is malfunctioning. Once approved, the attacker gains a session token and can further establish persistence, often by registering their own MFA device. The credential leak is the trigger for the entire attack chain.

In the 2023 MGM Resorts attack, Scattered Spider used a leaked credential obtained from an infostealer log to authenticate to the employee portal. They then bombarded the user with MFA push notifications. When the user finally approved one, the attackers escalated privileges and launched ransomware. (Source: CrowdStrike Global Threat Report 2024, Scattered Spider profile)

• MITRE ATT&CK Mapping: T1078 Valid Accounts is the initial access technique. T1556.006 Modify Authentication Process captures the MFA manipulation aspect. Push bombing itself is an exploitation of T1110 Brute Force, specifically credential stuffing combined with social engineering of the MFA approval workflow.
• Detection Strategy: Credential leak detection that identifies the employee’s password in stealer logs or combo lists days or weeks before the attack provides the earliest possible alert. Security teams can force password reset, revoke active sessions, and raise the employee's risk profile before the attacker attempts MFA fatigue.

Adversary-in-the-Middle Phishing Toolkits

AitM phishing tools exploit the architectural handshake between the user, the phishing page, and the real identity provider. Toolkits like EvilGinxX2, Modlishka, and more recently Tycoon, represent a significant evolution in MFA bypass. They do not try to break the MFA itself—they proxy the entire authentication session.

What Is Adversary-in-the-Middle MFA Phishing?

AitM phishing works by establishing a real-time reverse proxy between the victim and the legitimate service. The victim thinks they are logging into their company’s Office 365 portal, but they are actually on an attacker-controlled proxy. The proxy captures the password the victim enters (which the attacker may already have from a leak), relays it to the real Microsoft login page, captures the MFA token generated by the real authentication, and passes it to the attacker in a separate browser session. The attacker now has an authenticated session.

• Why Leaked Credentials Accelerate AitM Attacks: The attacker does not need to trick the user into entering a password they do not know. If the attacker already has the password from a combo list, they can either pre-fill the phishing page or skip the password entry step entirely, moving directly to the MFA code phase. This increases the speed and success rate of the attack.
• Session Persistence Risks: Once the attacker steals the session token, they can maintain access even if the user changes their password or resets MFA, because the token does not always validate against the identity provider’s reauthentication logic.
• Detection Strategy: Credential leak detection that identifies domain-wide credential exposure for multiple users can indicate a large-scale infostealer infection. Correlating leaked password alerts with unusual geo-location or device fingerprint anomalies in authentication logs can help identify AitM attacks in progress.

Session Token Theft and Session Hijacking

MFA bypass does not always mean rejecting the MFA challenge. Often, it means stealing the result of a successful MFA authentication. Infostealer malware families like RedLine Stealer, Vidar, Lumma Stealer, and META Stealer are explicitly designed to exfiltrate browser databases that contain session tokens, or "cookies," for logged-in sessions. These tokens represent authenticated sessions that have already passed MFA.

How Do Infostealers Bypass MFA Using Session Tokens?

The attack sequence begins with the victim downloading a cracked application, a phishing attachment, or a fraudulent software update that executes the stealer malware. The malware scans the browser’s profile directories, extracts the encrypted cookie databases, and decrypts them using APIs provided by the operating system. For Google Chrome-based browsers, the cookies are encrypted with AES-256 using a key stored in the OS’s cryptographic key store, which is accessible to a process running under the user’s context. The stealer packages these decrypted tokens into a log file, which is then exfiltrated to a command-and-control server.

SpyCloud’s 2024 Annual Identity Exposure Report found that over 25% of intercepted cookies in infostealer logs were still valid for more than 18 days after the malware infection. This gives attackers a significant window to use stolen session tokens to bypass MFA without needing the victim’s password or MFA code.

• Pass-the-Cookie vs Pass-the-Session: Pass-the-cookie involves taking the HTTP cookie header value and injecting it into a browser session on the attacker’s machine. Pass-the-session involves cloning the entire browser profile, including local storage and indexed databases, to reconstruct the full session context. Both techniques bypass MFA because the session was already authenticated.
• MITRE ATT&CK Mapping: T1539 Steal Web Session Cookie is the primary technique. T1505.003 Steal Web Session Data captures the broader data theft. T1078 Valid Accounts applies for subsequent access.
• Credential Leak Detection Role: Monitoring for stealer logs that contain session tokens tied to your domain is a direct detection mechanism. DarkThreat.AI’s credential leak detection module scans for these logs across underground markets, Telegram channels, and stealer log aggregators. Getting alerted to a stealer log containing your domain’s authentication tokens means you can invalidate all sessions and force reauthentication immediately.

MFA Enrollment Hijacking and Help Desk Social Engineering

MFA bypass techniques are not exclusively technical. Social engineering of help desk processes is a proven method for gaining MFA control, and it relies entirely on the attacker having leaked credentials that allow them to authenticate and provide convincing context during the call.

How Does MFA Enrollment Hijacking Exploit Leaked Credentials?

The attacker calls the organization’s IT help desk, claiming they have lost access to their MFA device and need to re-enroll. To verify their identity, the help desk often asks for the employee’s username, date of birth, employee ID, or the answer to a security question—all of which are commonly included in credential leak data or can be derived from it. The attacker provides the leaked password as a "verification" that they know the account, and the help desk, under pressure to resolve the ticket quickly, resets the MFA enrollment. The attacker then registers their own device or authenticator.

• Named Incidents: The 2022 Uber breach involved an attacker who obtained an employee’s password from a stealer log. When MFA blocked the initial login, the attacker called the help desk, presented the password as proof of identity, and convinced the help desk to approve a new MFA device. This gave the attacker full account access.
• Credential Leak Detection Countermeasure: When a credential leak detection system flags an employee’s password in an infostealer log, security teams should preemptively flag that account in the help desk system. Any request for an MFA reset from that account should trigger an out-of-band verification process, such as a manager approval or a video call.

SIM Swapping and SS7 Exploitation for SMS-Based MFA

SMS-based MFA has been widely criticized by security professionals, but it remains in use across many organisations, particularly in small to medium-sized businesses. Two technical attacks that bypass SMS MFA rely on leaked credentials as the initial access vector.

What Is a SIM Swap Attack Against MFA?

A SIM swap attack involves the attacker convincing the mobile carrier to transfer the victim’s phone number to a SIM card controlled by the attacker. Once achieved, any SMS messages, including MFA codes, are sent to the attacker’s device. The attacker uses a leaked password to log into the victim’s account, requests an SMS-based MFA code, and receives it on the swapped SIM.

• SS7 Protocol Exploitation: The Signaling System 7 (SS7) protocol, used to route SMS messages between mobile networks, has known vulnerabilities. Attackers with network access can intercept SMS messages at the protocol level without needing to perform a SIM swap. This requires higher sophistication but removes the carrier social engineering step.
• Detection Strategy: Credential leak detection provides the early warning. If an employee’s password is found in a leak, and their mobile phone is the primary MFA method, the organisation knows it has a high-risk combination. Force migration to app-based or hardware-based MFA before the attacker attempts SIM swapping. Monitoring for carrier notifications about SIM changes can also provide a detection signal.

Detection and Remediation Strategies for MFA Bypass

Preventing MFA bypass that originates from leaked credentials requires a shift left in the detection timeline. Waiting for an authentication anomaly is too late. The detection must happen when the credential appears in a stealer log, a combo list, or a credential market listing.

How DarkThreat.AI Approaches MFA Bypass Prevention

DarkThreat.AI addresses MFA bypass at its root cause by identifying credential exposure before attackers can weaponize it. The platform’s credential leak detection module monitors dark web forums like XSS.is, Exploit.in, and Russian Market, along with Telegram credential-selling channels and stealer log aggregators, for any credential, session token, or cookie associated with your domain. When a stealer log containing a valid session token is detected, DarkThreat.AI delivers an alert within seconds, allowing the IAM or SOC team to execute a token revocation and force reauthentication. For credential exposure without session data, the platform triggers password reset workflows and user notifications, closing the window between leak and exploitation. These capabilities integrate seamlessly with SIEM platforms via API, ensuring that credential leak intelligence feeds directly into detection rules correlating with authentication anomalies.

Related Resources

• Stealer Malware: Credential Theft and Detection — Explains how infostealer malware like RedLine and Lumma exfiltrate credentials and session tokens, and how to detect infections through credential leak signals.
• Combo Lists Explained: Monitoring for Mass Credential Exposure — Details how attackers compile combo lists from multiple data breaches and why monitoring for them is a critical layer in preventing credential-driven attacks.
• Leaked Credentials and Initial Access in MITRE ATT&CK — Maps the tactical role of leaked credentials across MITRE ATT&CK techniques, including T1078 and T1556, relevant to understanding MFA bypass attack chains.
• Initial Access Brokers: How Dark Web Monitoring Catches IAB Activity — Explains how IABs buy and sell access using leaked credentials, and how dark web monitoring can detect this activity before it leads to a breach.

Conclusion

MFA bypass techniques are not novel in their execution—most are variations of social engineering, session theft, or protocol interception that have existed for years. What has changed is the availability of high-quality, validated leaked credentials from infostealer malware and credential markets. Without a leaked credential, the attacker cannot trigger an MFA prompt, steal a session, or convince a help desk agent. Credential leak detection is the control that breaks the attack chain at step one. Security teams must treat leaked credentials as an active incident—one that demands immediate credential rotation, session invalidation, and user awareness. The future of identity security lies in monitoring for exposure before authentication is ever attempted. DarkThreat.AI provides that intelligence layer, giving organisations the visibility they need to render MFA bypass techniques ineffective.