Weak MFA Becomes an Attackers’ Gateway

Attackers exploit weak MFA implementation to bypass authentication by targeting the process around the login rather than defeating the cryptographic strength of the second factor. They may steal a session cookie, intercept a one-time code, manipulate an approval prompt or persuade a help desk employee to reset MFA. Multi-factor authentication therefore cannot be treated as a single control that is either present or absent.

Australian organisations face a familiar mix of cloud applications, on-premises systems, personal devices and outsourced support. SMS one-time passcodes remain common among small businesses and regional organisations, while larger companies use conditional access through providers such as Microsoft Entra ID, Okta or Google Workspace. The result is an identity estate in which authentication strength varies according to account age, device, administrator decisions and the documentation available to support staff.

Where MFA Controls Fail

MFA is effective when the identity platform can reliably verify something the user possesses, such as a registered cryptographic key. SMS and voice calls are weaker because the telephone network, a compromised mobile account or a persuasive social-engineering call can become part of the authentication chain. Email codes offer little additional protection when the same mailbox contains the original phishing message and password-reset material.

Weak configuration can also leave a route around otherwise sound factors. An adversary-in-the-middle phishing site may relay credentials and a genuine code to the real service, then return the authenticated session to the attacker. Stolen session cookies are particularly valuable because they can bypass MFA for the lifetime of the session. Conditional access that permits sign-ins from untrusted devices can magnify the problem.

Recovery paths frequently deserve more attention than the primary login. Attackers may impersonate an employee whose phone has been lost or whose MFA device needs replacing. Help desks in Sydney, Melbourne, Brisbane and other cities can become targets when staff rely on knowledge-based questions, manager approvals visible in collaboration tools or information taken from social media. A convincing attacker may simply say they have “changed phones” and need a new code sent to the old number.

Common Attack Paths Attackers Use

Phishing remains effective because it can combine several techniques. A fake sign-in page may capture a password, relay an OTP and steal the resulting session. QR-code phishing attempts to register the attacker’s device as an authenticator, while consent phishing asks a user to approve an OAuth application that grants mailbox or cloud-storage access. These flows are difficult for users to distinguish when a page closely imitates a familiar identity provider.

Push bombing, also called MFA fatigue, sends a succession of approval notifications until someone approves one accidentally. Number matching helps by showing the number and location of the requesting authentication session. Without it, a user may dismiss repeated prompts as “the system being cranky,” particularly when notifications arrive outside working hours. Attackers then use the approved session to change recovery details and establish a durable foothold.

An unexpected destination should be investigated even when it appears to offer a legitimate service. During phishing triage, a link such as the McAfee activation page could be examined as a possible lure rather than accepted at face value. A familiar product name, polished interface or HTTPS connection does not establish that a site is authorised. Security teams should record the URL, redirect chain and certificate details without asking staff to interact with it further.

Warning Signs Australian Teams Should Recognise

Repeated MFA prompts followed by an approval are a strong reason to review identity-provider logs. Other warning signs include a new authenticator, an altered recovery phone number, a sudden rise in successful password resets or a user reporting that their phone is receiving unfamiliar codes. Token theft can leave few visible traces because the attacker may reuse a valid session without seeing another challenge.

These behaviours fit patterns documented in broader cyber threat coverage, but a single alert rarely proves compromise. Shared offices, mobile networks, virtual private networks and travel can all alter a familiar access pattern. Investigators should compare the claimed location with the account’s normal pattern and look for device identifiers, changes in privilege and subsequent mailbox activity.

Australian market conditions add context to that review. Many small organisations depend on managed service providers, while distributed teams across Perth, Adelaide, Brisbane and the eastern states create support handoffs across time zones. Attackers can use Australian +61 numbers to make contact appear local, and international operators can ring during an Australian evening when the employee is alone. The Australian Signals Directorate’s Essential Eight remains a useful benchmark for organisations assessing whether MFA is phishing-resistant and correctly applied.

If authentication activity is followed by mailbox forwarding rules, unusual OAuth consent, credential exports or access from unfamiliar infrastructure, containment should begin quickly. Organisations subject to the Privacy Act may also have obligations to assess whether the incident meets the Notifiable Data Breaches scheme. Any account recovery should follow a verified process rather than allowing the suspicious request to set the new authenticator.

Defences Beyond the Login Screen

Phishing-resistant authentication with FIDO2-compatible security keys or passkeys removes the reusable OTP from many phishing flows. Where push notifications remain necessary, number matching should be mandatory, and authenticator registration should require the user to scan a QR code directly from the legitimate application. Short session lifetimes, restricted token lifetimes, device-compliance requirements and disabled legacy authentication reduce the value of stolen credentials.

Vulnerability and configuration management remain closely connected to identity security. Unpatched internet-facing appliances and services can expose credentials, signing keys or active sessions even when MFA is enabled. SecNews24’s critical buffer overflow report is a separate but instructive example of how a flaw in widely deployed code can create broad exposure. Rapid triage, dependency inventories and tested vendor patches should form part of the same identity-defence programme.

Response teams need the ability to revoke sessions, invalidate refresh tokens, rotate application passwords and disable suspicious authenticators. Endpoint detection and response tools can reveal malware or credential theft that preceded an MFA bypass, while cloud audit logs can show whether an attacker changed roles, granted persistent access or accessed sensitive files. Logging must be centralised and retained long enough to cover slow discovery, which can occur when an attacker patiently waits between sign-ins.

Operational Checks for Australian Teams

Authentication reviews should connect identity-provider records, email audit trails, endpoint telemetry and help-desk notes. The objective is to determine whether a prompt was ignored, approved, relayed or accompanied by a deeper compromise. Staff should be able to report “code fatigue” without embarrassment, and support personnel should treat repeated approval requests as a security event rather than a routine technical fault.

The first stage is to identify suspicious changes and correlate them with subsequent activity.

Warning signals worth reviewing

• Repeated MFA prompts followed by an approval or an unexplained device registration
• New recovery addresses, telephone numbers, authenticators or application passwords
• OAuth consent granted to an unfamiliar publisher or during an odd sign-in
• Successful sign-ins followed by mailbox forwarding, rule changes or file access
• Password-reset calls using details that appear on social media or in corporate directories

Once warning signs are detected, teams need controls that remain effective even when a user makes a mistake. Verification and containment should occur within the same incident process.

Controls worth verifying

• Require phishing-resistant FIDO2 authentication for privileged and high-risk accounts
• Use number matching, short-lived sessions and tightly restricted token lifetimes
• Disable legacy authentication, app passwords and unmanaged-device access where feasible
• Verify recovery requests through a known contact method and authorised approval path
• Centralise identity logs and test rapid session revocation and credential rotation

A resilient MFA programme is measured by the weakest recovery route and the shortest lifetime of a stolen session, not by the presence of a second-factor screen. Australian defenders can reduce risk by making phishing-resistant authentication the standard, treating support impersonation as an authentication attack and ensuring that suspicious activity ends with immediate containment rather than another prompt.