2FA raises the bar significantly, but it isn't unbreakable. Here's how attackers get around it in practice.
1. Phishing with real-time proxies (adversary-in-the-middle)
This is the most common method today. Tools like Evilginx or Modlishka sit between you and the real login page:
- You get a phishing link that looks identical to the real site
- You enter your username, password, and your 2FA code
- The attacker's proxy relays everything to the real site in real time
- The real site issues a session cookie, which the proxy captures
- The attacker now has your live, authenticated session — no need to know your password or 2FA code again
This works against SMS, authenticator apps, and even some push-based 2FA, because it doesn't attack the 2FA itself — it steals the session that comes after successful 2FA.
2. Session hijacking / cookie theft
Once you're logged in, your browser holds a session token or cookie. If malware on your device (an infostealer like RedLine or Raccoon) grabs that cookie, the attacker can import it into their own browser and be instantly logged in — 2FA already passed, nothing to bypass.
3. SIM swapping
For SMS-based 2FA specifically: attackers social-engineer your mobile carrier into porting your number to their SIM. Your calls and texts, including OTP codes, now go to them.
4. MFA fatigue / push bombing
For push-based 2FA (like Duo or Microsoft Authenticator), attackers who already have your password spam you with login approval requests, hoping you'll eventually tap "Approve" out of annoyance or confusion — or because you're tricked into thinking it's legitimate.
5. SIM-less OTP interception
Malware on Android phones can read incoming SMS messages directly and forward OTP codes to the attacker without needing a SIM swap.
6. Social engineering the recovery flow
Rather than attacking 2FA directly, attackers target account recovery — "I lost my phone" flows, support desk resets, or security questions — which sometimes bypass 2FA entirely.
7. Malicious or compromised OAuth apps
Instead of stealing credentials, attackers get you to authorize a malicious OAuth app ("Sign in with Google/Microsoft") that requests broad permissions. This doesn't touch your 2FA at all — you grant token-based access directly.
How to actually protect yourself
- Use phishing-resistant 2FA: hardware security keys (FIDO2/WebAuthn, like YubiKeys) or passkeys — these are bound to the legitimate domain and can't be relayed by a proxy
- Avoid SMS 2FA where possible; prefer authenticator apps or hardware keys
- Never approve a push notification you didn't initiate
- Check URLs carefully before entering credentials — bookmark sensitive login pages instead of clicking links
- Keep devices free of malware — this is how session cookies get stolen in the wild
- Use unique passwords per site (password manager) so a breach on one site doesn't cascade
- Review OAuth app permissions periodically and revoke ones you don't recognize
If you're not sure how resilient your organisation's authentication setup actually is against these techniques, that's exactly what a targeted assessment is for. See our Vulnerability Assessment service for current scope and pricing, or get in touch to talk through your specific setup.