MFA Bypass

Adversaries may intercept multi-factor authentication (MFA) secrets or authentication sessions to gain access to systems and services. Documented paths include keylogging a smart-card password during normal use, capturing one-time token input, proxying authentication from a compromised system with an inserted hardware token, and real-time phishing proxies that capture session tokens after a victim completes a non-phishing-resistant MFA challenge. These are distinct methods; no single procedure applies to every MFA factor, and the steps below are examples rather than an exhaustive list.