- Stolen credentials drive initial access in over 80% of enterprise breaches (Verizon DBIR). Adversary-in-the-middle attacks have widened that gap, not narrowed it.
- AiTM proxy attacks relay your credentials and MFA challenge to the real login service, capture the session token, and return a normal successful login. TOTP and push notifications provide no protection.
- FIDO2 passkeys and hardware security keys stop AiTM attacks because the cryptographic challenge is bound to the exact origin URL. A phishing domain gets a different challenge and can sign nothing.
- Pass-the-cookie attacks replay stolen session tokens with no credentials required. Token lifetime policies, Conditional Access device compliance, and CAE are the primary controls.
- MFA fatigue attacks send push notifications in rapid succession until a user approves one to make them stop. Number matching prevents this: the user must type a number shown on the login screen, so automatic tapping does nothing.
- Credential defence requires phishing-resistant MFA on privileged accounts, Conditional Access with device compliance, short token lifetimes, and alerts on impossible travel and first-seen device sign-ins.
Credentials are the primary breach vector
Enterprise breach reporting through the 2010s centred on malware: ransomware groups, nation-state implants, zero-day exploits. Attackers have since shifted to credential theft. It is cheaper, faster, and harder to detect. A legitimate account signing in through an authorised identity provider looks like a normal login to most monitoring systems.
The Verizon DBIR puts stolen credentials in over 80% of hacking-related breaches. The supply is enormous: HaveIBeenPwned indexes over 13 billion breached accounts from hundreds of historical breaches. Stuffing tools test these at scale with request throttling and IP rotation to avoid rate-limiting.
MFA stops credential stuffing and most automated attacks. Attackers adapted. A subset now targets the authentication session rather than the credentials, and TOTP or push notifications offer no protection against those attacks.
Six bypass methods
Credential attacks differ by what they target and how they succeed. A control that stops credential stuffing may do nothing against session token theft.
What each MFA type actually stops
MFA factor choice determines the attack surface. SMS OTP and push notifications stop credential stuffing. Neither stops a real-time AiTM attack. Knowing where each factor's protection ends tells you which to upgrade first.
* FIDO2 stops AiTM at authentication but does not protect session tokens after a legitimate login. Device compliance and CAE are required for post-authentication session security.
What makes FIDO2 different
TOTP codes, push approvals, and SMS messages all share one property: they can be forwarded. The user completes the challenge and the proxy relays it. The session opens. The proxy takes the cookie.
FIDO2 works differently. The private key lives on the device and never leaves it. The browser signs a challenge that includes the requesting origin URL. A phishing domain at login-microsoft-365.com gets a challenge stamped with that domain. The browser compares it to the registered origin, login.microsoft.com, and refuses to sign. The proxy gets nothing to forward.
NIST SP 800-63B classifies FIDO2 as phishing-resistant for exactly this reason. Both CISA and NCSC recommend it for high-value accounts.
A user who receives repeated push requests may approve one just to stop the noise. Microsoft's data shows number matching cuts approval rates during push bombing by over 99%. If you use push MFA, enabling it is a free configuration change that removes almost all successful MFA fatigue attacks.
Defending against session-layer attacks
Session token theft happens after authentication. The controls that matter here act on token lifetime and device binding, not on the login itself.
Token lifetime policies
Long-lived access tokens give an attacker time to use a stolen session. Entra ID token lifetime policies shrink that window for sensitive applications, but shorter sessions mean more frequent re-authentication. Continuous Access Evaluation (CAE) solves both for supported apps: it revokes tokens in near real time when Entra ID detects a risk event, such as an impossible travel sign-in or a reported compromise.
Device binding through Conditional Access
Conditional Access with device compliance checks that the session's originating device is enrolled and managed. An attacker replaying a stolen token from an unmanaged machine fails the compliance check and gets blocked. Stolen tokens stop working against applications that enforce this policy.
Monitoring for token anomalies
Impossible travel alerts catch sign-ins from locations that are physically incompatible. A user who authenticated in Amsterdam at 09:00 cannot also sign in from Moscow at 09:15. Entra ID Identity Protection and Microsoft Sentinel both surface these detections. Wire them to automated responses: session revocation, forced re-authentication, or an alert to the security team.
Start with privileged accounts
Phishing-resistant MFA delivers its highest value on the accounts that carry the most access. Administrative accounts, elevated service accounts, finance staff, and board members make up a small fraction of your users but account for most of the damage a successful credential attack can do.
Rolling out FIDO2 across a large organisation takes time: device distribution, user training, policy rollout. The 20 accounts that matter most can be covered in days. Start with Conditional Access policies requiring phishing-resistant authentication for privileged role access, and PIM to prevent administrative roles from sitting permanently active.
TOTP-protected admin accounts are the prize target in AiTM campaigns. The credential, the MFA code, and the session token all flow through the same proxy. FIDO2 breaks that chain: the key never leaves the device, the signature never matches a phishing domain.
Seven controls to implement now
- Enable number matching on all push MFA: a free Authenticator setting that stops push bombing.
- Block legacy authentication protocols: SMTP AUTH, POP3, IMAP, and older Office clients bypass MFA and are the most common credential stuffing path.
- Enforce phishing-resistant MFA for privileged accounts: Conditional Access authentication strength policies can require FIDO2 for administrative roles today.
- Enable Entra ID Identity Protection: real-time risk scoring for sign-ins, leaked credential detection via HIBP, and automated response policies.
- Configure Continuous Access Evaluation: it revokes Microsoft 365 tokens in near real time when Entra ID detects a risk event.
- Restrict OAuth application consent: set tenant-wide consent policies in Entra ID to block users from approving unverified third-party apps.
- Monitor impossible travel and new device sign-ins: configure alerting rules so anomalous session patterns trigger immediate notification or automated revocation.