Follow the Access · 12 — The MFA Bypass: Defeating the Second Factor Without Breaking It

Follow the Access — Case 12. This register follows the intruder from the login prompt to the foothold's fate, and closes each case on what the access becomes: RANSOMED · MINED · PROXIED · HARVESTED · WIPED · RESOLD.

Four times now, this register has named multi-factor authentication as the control that matters most — the thing that makes a stolen password insufficient, that breaks the payoff of the whole credential economy, that a defender should reach for above all else. That advice is correct. But it carries an unstated assumption, and this case is about attackers who exploit exactly that assumption: that all MFA is equal, and that having it means being protected. They have discovered, and industrialized, the truth that most forms of the second factor rest on a human decision — a tap to approve, a code to read, a reset to grant — and that a human decision can be defeated without touching the mathematics behind it.

This is the MFA bypass, and its elegance is that it never breaks anything. The cryptography of the second factor remains perfectly sound; the attacker simply arranges for the human who operates it to open the lock voluntarily. Two techniques dominate. In the first, push-bombing, the attacker who already holds the victim's password spams them with approval prompts until, worn down, they tap "approve." In the second, help-desk social engineering, the attacker calls the target's IT support, impersonates an employee, and talks the agent into resetting the account's password or re-enrolling its MFA to a phone the attacker controls. Neither defeats the algorithm. Both defeat the person. And both have been made into a specialty by crews like the one tracked as Scattered Spider, who used them to walk through the identity controls of some of the largest and best-resourced companies in the world.

So the disposition is HARVESTED, because the bypass completes what a stolen password began — it delivers the fully authenticated account — and the crews who specialize in it, Scattered Spider chief among them, turn that account into aggressive data-theft extortion. This is the case about the second factor that was defeated without being broken, and about the sharpening of the register's most-repeated advice: not merely "use MFA," but "use the kind of MFA that a tired employee and a helpful help-desk agent cannot be talked into surrendering."

1. The Human at the Center of the Second Factor

Begin with why MFA is bypassable at all, because the register has praised it so highly that its vulnerability needs to be located precisely. Multi-factor authentication works by requiring something beyond the password — something you have (a phone, a key) or something you are (a fingerprint). The cryptographic core of a good second factor is genuinely strong; no one in this case is factoring large primes or breaking a hardware key's chip. The weakness is not in the factor's mathematics but in how the common implementations connect that mathematics to the user — and that connection, in most deployments, is a human decision.

Consider the two most widespread forms. A push notification asks the user to approve a login by tapping a button on their phone; the security rests entirely on the user tapping "approve" only for logins they initiated. A one-time code asks the user to read a number and type it into the login page; the security rests on the user typing that code only into the real site, for a login they intended. In both, the cryptography is fine, but a human being stands at the center of it, making a judgment — is this login mine? — and that judgment can be manipulated. It can be exhausted, by flooding the user with prompts until they approve one to make the flood stop. It can be deceived, by an adversary-in-the-middle page (Case 04) that relays the code. And the enrollment of the factor itself — the process by which a user's phone or key is registered as their second factor, and the reset process when they lose it — is administered by other humans, the help desk, who can be talked into re-registering the factor to the wrong device. Everywhere the second factor touches a human, it inherits that human's fallibility, and the MFA-bypass crews attack exactly those touch points.

This is the key reframing, and it sharpens the register's earlier praise rather than retracting it. MFA is not one thing; it is a family of controls that vary enormously in how much they depend on a human decision, and therefore in how bypassable they are. The register was right that MFA is the most important control — but the sentence needs its ending: the most important control, when it is the kind that does not rest on a human tap or a human reset. The forms that do rest on those are the forms this case defeats, and defeats routinely, because a control anchored to human judgment is only ever as strong as human judgment under pressure — which is to say, not very.

2. Push-Bombing — Winning by Attrition

Take the first technique in detail, because its crudeness is precisely what makes it unsettling. Push-bombing, also called MFA fatigue, requires almost no sophistication. The attacker already has the victim's password — bought, phished, or harvested from the earlier cases — and the only thing standing between him and the account is the push approval. So he simply tries to log in, over and over, and each attempt sends a fresh approval prompt to the victim's phone. Then he waits, and repeats, and repeats.

The victim's experience is the weapon. Their phone buzzes with an approval request. They ignore it. It buzzes again. And again. Ten times, twenty, fifty. At three in the morning. During a meeting. While they are trying to work. Each prompt asks the same question — approve this login? — and the victim, who did not initiate any login, is at first puzzled, then annoyed, then desperate to make the buzzing stop. And eventually, a meaningful fraction of victims tap "approve" — not because they are fooled about the login being theirs, but because they are worn down, or confused into thinking the prompts are a glitch that approving will resolve, or simply because tapping the button is the fastest way to end the barrage. That single tap authenticates the attacker's session. The war of attrition is won not by defeating the victim's knowledge but by exhausting their patience.

What makes push-bombing so instructive is that it turns the security feature into the vulnerability. The push prompt exists precisely to require a deliberate human "yes" for every login — that friction is the point of it. Push-bombing weaponizes that friction: it generates so much of the deliberate-yes friction that the human, overwhelmed, gives the yes just to escape it. The control designed to make the user consciously confirm each login is defeated by making the user confirm one login unconsciously, out of fatigue. It is a reminder that any security mechanism resting on repeated human vigilance is vulnerable to being flooded past the point where vigilance holds, and that attackers understand human psychology as a resource to be exhausted. The defense, as Section 5 will note, is partly to blunt the flood (number-matching prompts, rate limits) and ultimately to remove the human tap entirely — because a factor that cannot be approved by a tired thumb cannot be push-bombed.

3. The Help Desk — The Softest Door in the Identity Perimeter

Now the second and often more devastating technique, because it attacks not the user but the people who administer the user's identity, and they turn out to be the softest target of all. Every organization's identity system has a reset process: when an employee loses their phone, forgets their password, or gets locked out, someone must be able to restore their access, and that someone is the IT help desk. The help desk's entire purpose is to help — to get frustrated, locked-out employees back to work quickly and courteously. And that purpose is exactly what the attacker exploits.

The technique is a phone call. The attacker, having researched a real employee — their name, role, manager, and enough personal detail scraped from breaches and social media to sound authentic — calls the help desk impersonating them. He is locked out, he says, or he has a new phone and needs his MFA re-enrolled, and he is in a hurry, perhaps with a plausible note of stress or authority. The help-desk agent, whose job is to resolve exactly this kind of request and who faces a caller who knows the right details and sounds legitimately frustrated, does what they are trained to do: they help. They reset the password, or they re-enroll the MFA to the new device — the attacker's device — and in doing so they hand the attacker both factors at once. No push to bomb, no code to phish; the help desk simply gave the account away, because giving accounts back to their owners is what it is for. CrowdStrike documents this vishing-and-help-desk tradecraft as central to Scattered Spider, and the actor's record is the proof of its power: fluent, confident social engineering of help desks defeated the identity controls of large, sophisticated, well-defended enterprises, because those enterprises' strong technical security ran through a human reset process that a convincing phone call could subvert.

The lesson is structural and uncomfortable: the identity perimeter includes the humans who administer it, and those humans are as socially engineerable as any other. An organization can deploy the strongest MFA, enforce it everywhere, and still be undone by a single help-desk agent who, in a moment of helpfulness, resets the wrong person's access. The help-desk reset is a privileged operation — it can grant or restore access to any account — but it is very often not treated as one, staffed instead by overworked agents under pressure to resolve tickets fast and be pleasant doing it. Scattered Spider's success was, in large part, the discovery that the most valuable privilege in the enterprise — the ability to reset identity — was guarded by the least-defended humans in it. The softest door in the identity perimeter is not a user; it is the desk that exists to open doors.

4. Distinct From the SIM Swap — and Why That Matters

Pause for a clarification the register owes, because a reader who followed the money series will recognize a cousin here, and the distinction is important. The money series documented the SIM swap, which also defeats MFA — but by a different mechanism, and naming the difference sharpens the whole picture. The SIM swap defeats SMS-based MFA by hijacking the victim's phone number: the attacker transfers the number to their own SIM, so the text-message codes arrive on the attacker's phone. It is an attack on the phone number as an identity anchor.

The techniques in this case touch the phone number not at all. Push-bombing attacks app-based push approvals through fatigue — the victim keeps their number, keeps their phone, and is defeated by their own tap. Help-desk bypass attacks the human reset process through impersonation — again, the phone number is irrelevant; the attacker talks a person into re-enrolling the factor. Three techniques — SIM swap, push-bombing, help-desk social engineering — reach the same destination (a defeated second factor) by three different roads (hijacking the number, exhausting the user, deceiving the administrator). And the reason the distinction matters is that it reveals the general principle behind all of them: every form of MFA that ultimately rests on a human element — a number the human receives, a prompt the human approves, a reset the human grants — has a corresponding human-directed bypass. SMS rests on the number, so hijack the number. Push rests on the tap, so exhaust the tapper. Enrollment rests on the help desk, so deceive the help desk.

This generalization is the case's deepest contribution, because it tells the defender where the real fix must lie. If every human-anchored second factor has a human-directed bypass, then no amount of choosing among human-anchored factors escapes the problem — moving from SMS to push does not solve it, it just changes which bypass applies. The only escape is a second factor that removes the human decision from the loop, that cannot be approved by a tired thumb, phished onto a fake page, or reset by a helpful agent, because its security does not rest on a human judgment at all. That factor exists, and the case builds to it: phishing-resistant, hardware-bound MFA. The three bypasses are three proofs of the same theorem, and the theorem's conclusion is that human-mediated MFA is defeasible by design — which is why the register's advice must sharpen from "use MFA" to "use the MFA that took the human out of the decision."

5. HARVESTED — The Account, and What the Crews Do With It

Now the disposition, because the MFA bypass is not the end of an attack but the completion of an entry, and what follows determines the fate. The bypass finishes the authentication that a stolen password began: the attacker now holds the fully authenticated account, past the second factor, logged in as the victim. From here the paths of the earlier cases open — but the crews who specialize in MFA bypass, Scattered Spider foremost, have a signature, and it is data-theft extortion, which is why the register marks the disposition HARVESTED.

Trace what these crews do with the harvested account. They use it to move into the environment — often the account is a foothold into a corporate identity system, a cloud tenant, or an administrative console. They escalate and spread, frequently using the same help-desk and social-engineering techniques against additional accounts, and the valid-account, living-off-the-land tradecraft of Case 11. And their monetization emphasizes aggressive data theft: they locate and exfiltrate the most sensitive data they can reach — customer records, source code, financial and personal data — and then extort the victim under threat of publishing it, sometimes pairing the data-theft extortion with ransomware, sometimes relying on the stolen data alone. The account was the harvest; the data it unlocked is what the harvest yielded; the extortion is how the yield becomes money. The register marks this HARVESTED rather than only RANSOMED because the defining act of these crews is the harvest-and-extort of data built on the seized identity, of which encryption is an optional accompaniment rather than the core.

The broader significance is that the MFA bypass is what makes the modern identity-based intrusion possible against defended targets. An organization that has deployed MFA has, in a sense, done the right thing — and the bypass crews exist precisely to defeat organizations that did the right thing but did it with the wrong kind of MFA. The victims of Scattered Spider were not careless firms with no second factor; they were sophisticated enterprises with MFA enforced, defeated because their MFA rested on human decisions that fatigue and impersonation could subvert. This is the case's hard message: deploying MFA is necessary but, in its weaker forms, not sufficient, because a control anchored to human judgment can be defeated by attacking the judgment. The harvest was reaped not from the unprotected but from the protected-with-the-wrong-thing, which is exactly why the distinction between forms of MFA is not pedantry but the whole game.

6. The counter-narrative, steelmanned

The strongest objection to this case is that it undercuts the register's own most important advice — that by cataloguing MFA bypasses, it hands defenders an excuse to conclude MFA is not worth deploying, doing more harm than the attacks it describes.

The argument runs like this. The register has spent eleven cases telling people to use MFA, correctly, and now spends a twelfth explaining how MFA is defeated — which a reader could easily take as "MFA does not work, so why bother." Since the overwhelming majority of accounts have no MFA at all, and since even the bypassable forms stop the vast bulk of automated credential attacks (the brute force and password spraying of Case 02, the simple credential stuffing that never involves a live attacker to push-bomb anyone), publicizing the bypasses risks discouraging the single most effective control against the most common threats. The nuance about phishing-resistant factors, the objection continues, is lost on most readers, who will remember only that "hackers can get past MFA," and some fraction of them will use that as a reason to keep doing nothing. On this view the case is technically accurate and practically harmful.

The register takes the risk seriously and rejects the conclusion, because the remedy for a dangerous half-truth is the full truth, not silence. Yes, MFA — even the bypassable kind — is vastly better than no MFA, and this case says so directly: the crews here defeat the protected-with-the-wrong-thing, not the unprotected, and the automated attacks that dominate the register are stopped cold by any second factor. Nothing in the case argues against deploying MFA; it argues against deploying the weakest MFA and believing the job is done. But the objection's proposed cure — do not tell people the bypasses exist, lest they lose heart — is exactly the complacency the bypass crews feed on. Scattered Spider's victims were defeated in part by a false sense of security: they had MFA, they believed that settled the matter, and they had not hardened the help desk or moved privileged accounts to hardware keys because they did not know the bypasses applied to them. Telling defenders precisely how their MFA can be defeated is what motivates them to deploy the MFA that cannot be — and to guard the help desk as the privileged operation it is. The honest message is not "MFA fails" and not "MFA suffices," but the harder, truer middle: MFA is essential, most MFA is bypassable by attacking the human, and the fix is the phishing-resistant kind plus a hardened reset process. A register that withheld the bypasses to protect a comforting simplicity would be leaving its readers in exactly the false security the attackers exploit.

7. Disposition — HARVESTED

Case 12 followed the attackers who defeat multi-factor authentication without breaking it — by attacking the human decision the common forms rest on rather than the cryptography behind them. Push-bombing exhausts the user with approval prompts until a fatigued thumb taps accept; help-desk social engineering impersonates an employee and talks IT support into resetting the password or re-enrolling the factor to the attacker's device. Neither breaks the math; both defeat the person, and crews like Scattered Spider made them a specialty potent enough to walk through the identity controls of the largest and best-defended enterprises. The case is distinct from the money series' SIM swap — a third road to the same place — and together the three prove one theorem: every second factor anchored to a human decision has a human-directed bypass.

The disposition — the foothold's fate — is HARVESTED. The bypass completes the authentication a stolen password began, delivering the fully authenticated account, and the specialist crews turn it into aggressive data-theft extortion — exfiltrating the sensitive data the identity unlocks and demanding payment under threat of publication, sometimes with ransomware alongside. HARVESTED, because the defining act is the harvest-and-extort of data built on the seized identity. And the victims were not the careless but the protected-with-the-wrong-thing: enterprises that deployed MFA and were defeated because it rested on a tap or a reset a human could be talked out of.

The register's most-repeated advice sharpens here into its final form. MFA is a gradient of strength: SMS weakest, push and codes human-mediated and bypassable, number-matching better, and phishing-resistant hardware keys — FIDO2/WebAuthn, cryptographically bound to the real site — resistant to all of it, because they cannot be fatigue-approved, relayed, or reset to a stranger's device. So the advice is not "use MFA" but "use phishing-resistant MFA," and harden the help-desk reset as the privileged operation it is, with out-of-band verification and the training to treat an urgent caller as a red flag. The vectors do not lie: the lock was never broken; the tired employee tapped yes, or the helpful agent reset the key to a stranger's phone, and the account was harvested and its data extorted while the cryptography stood perfectly, uselessly, intact. We do not judge. We record. We let people judge — and then, if they are wise, take the human's tap out of the lock.

Follow the Access continues. Case 12 disposition: HARVESTED. Confidence: HIGH — the MFA-fatigue/push-bombing technique is documented (MITRE T1621), and the help-desk vishing-and-MFA-reset tradecraft is documented by CrowdStrike and others as central to Scattered Spider; the gradient of MFA strength and the phishing-resistance of FIDO2/WebAuthn are established in NIST SP 800-63B and CISA guidance. The case is explicitly distinguished from the SIM swap of the money series (a different mechanism to the same end). The HARVESTED disposition reflects the data-theft-extortion signature of the specialist crews; the completed account connects to the valid-account tradecraft of Case 11 and the credential producers of Cases 02, 04, and 09. Classification: TLP:WHITE. Include everything — the vectors do not lie, and they do not judge. The reader judges the tired tap, the helpful reset, and the strong lock opened from the inside.