MFA Locked the Front Door. Attackers Found the Garage.

Chris Clements, VP of Solutions Consulting & Client Experience

Key Takeaways

• A password is a secret users have to hand over every time they log in, which makes it a pretty lousy secret. Attackers phish, buy, guess, and reuse them at industrial scale. 
• MFA still stops a huge volume of attacks, but text codes and push prompts can be relayed, worn down, or talked around. Attackers increasingly steal the session after login instead of the password before it. 
• The weakest part of most account security isn’t the login page. It’s the password reset, the help desk call, and the “temporary” MFA exception from three years ago. 
• Phishing-resistant authentication, locked-down recovery processes, and someone watching what happens after login do far more to protect business accounts than another password complexity rule. 

A Secret Everyone Knows

I’ve lost count of the penetration tests where the password was the easy part. Passwords still matter, but they’re rarely what worries me most anymore. That honor goes to the reset function, the help desk call, and the stolen session that skips the login screen altogether. 

Here’s the fundamental issue: a password is a secret that only works if you hand it over. Every time a user logs in, they type that secret into whatever page is in front of them and trust it’s the right one. Attackers know this, which is why they rarely bother “hacking” a password the way it happens in the movies. They just ask for it, buy it, or wait for someone to reuse it. 

Spraying a handful of seasonal favorites against an external login portal works far more often than it should (Fall2026! is about to have a very big couple of months). Once we’re inside, cracking a dump of password hashes usually produces a depressing pile of results before lunch. And those complexity rules everyone loves? Mostly they teach people to capitalize the first letter and tack an exclamation point on the end. Cracking tools have accounted for that trick since before most of your users owned a smartphone. 

Yes, the 2026 Verizon Data Breach Investigations Report made headlines when vulnerability exploitation edged out stolen credentials as the top way attackers get in, a first in the report’s 19-year history. Please don’t read that as passwords getting safer. Attackers found a faster door. They didn’t board up the old one, and stolen credentials are still how they get around once they’re inside. 

MFA Helped. Then Attackers Adjusted.

MFA is still one of the most useful controls we have for protecting accounts. If you have business accounts without it, stop reading and go fix that. 

The catch is that the most common forms of MFA, a code by text message or a push notification on your phone, stop someone who has only stolen your password. Attackers figured out how to work around that. Today they: 

• Relay the login in real time. Adversary-in-the-middle phishing kits sit between the user and the real sign-in page, pass along the password and MFA code, and keep the session token for themselves. The user sees the prompts they expect and gets logged in. So does the attacker. One campaign Microsoft reported in May 2026 targeted more than 35,000 users across 13,000+ organizations in just three days. 
• Wear people down. Fire off enough push prompts at 11 p.m. and somebody eventually taps “Approve” just to make it stop. That’s more or less how attackers breached Uber in 2022. 
• Skip the login entirely. Infostealer malware grabs saved passwords, browser cookies, and session tokens, so the attacker can walk in as the user without ever seeing a login prompt. 
• Call the help desk. Why fight MFA when a helpful support tech will reset it for you? That’s reportedly how the 2023 MGM Resorts breach started: one phone call. 

None of this makes MFA useless. It means MFA is a good lock on the front door, and attackers have started coming in through the garage. 

The Front Door Isn’t the Problem Anymore

From the pen testing side, when an organization has solid MFA on its main login, we stop staring at the main login. We start looking for the side doors, and we usually find at least one: 

• Password reset flows that rely on answers an attacker can find on LinkedIn or buy for a few bucks. 
• Help desk identity checks that boil down to “What’s your employee ID?” (Helpfully printed on the badge in their LinkedIn photo, naturally.) 
• Legacy protocols and service accounts still using ‘temporary’ MFA exemptions from a rollout three years ago.
• Shared admin accounts whose password lives in a spreadsheet with a subtle name like passwords_FINAL_v2.xlsx. 
• Third-party apps and OAuth integrations with standing access to email and files that nobody has reviewed since they were connected. 

Somewhere in your environment there’s an MFA exception list nobody has looked at since it was created. Attackers are very happy to read it for you.

What Actually Works

Before anyone writes another password rule, find out which accounts can already walk around the controls you have. Here’s where I’d put the effort instead: 

• Move the accounts that matter to phishing-resistant authentication. Properly deployed FIDO2 security keys and passkeys only work with the real site, so a convincing copy of the sign-in page gets nothing. Start with admins, executives, finance, and IT, and lock down enrollment and recovery just as tightly. Otherwise attackers will just go after those instead. 
• Treat account recovery like the high-risk event it is. If an attacker can look it up, guess it, or buy it, it doesn’t count as identity verification. That rules out employee IDs, birthdays, and the last four of a Social. Never reset anything on the inbound call. Hang up and call back at the number in the HR system, not the one the caller gives you. Alert on every password reset and MFA re-enrollment so a surprise change gets looked at fast. 
• Make people prove who they are. A quick video call where someone compares their government ID with the photo HR has on file, or a walk over to the IT desk, beats any security question. “I recognize their voice” is out, now that a few seconds of audio from a conference talk or a voicemail greeting is enough to clone it. A manager vouching through a separate channel adds another layer on top of the ID check, but it doesn’t replace it. For admins and executives, require two people to approve the reset. 
• Kill legacy authentication. If a protocol or service account can’t do modern authentication, it’s an open window. That “temporary” exception from the rollout three years ago? Today’s a great day to end it. 
• Make a login prove more than a password. Conditional access lets device health, location, and sign-in risk decide who gets in. The right password from an unmanaged laptop in a country you don’t do business in shouldn’t get the same welcome as one from a company device at HQ. 
• Watch what happens after login. Impossible travel, new inbox forwarding rules, odd token use, and unexpected app consent grants are often the first sign that an attacker already has access to an account. Somebody has to actually be looking at those alerts, including at 2 a.m. on a Saturday. 
• Make passwords less important, not more complicated. Long passphrases, a password manager, and screening against known-breached passwords beat a forced 90-day rotation that turns Summer2026! into Fall2026!. NIST stopped recommending routine forced changes years ago. It’s time the rest of us knock it off. 
• Test it the way an attacker would. That includes the reset process and the help desk phone line, not just the login page. Finding out your recovery workflow is the weak link costs a lot less during a pen test than during an incident. 

Stop Asking Passwords to Carry the Entire Load

Passwords came from a much simpler threat environment. Attackers have spent years industrializing ways around them, and around first-generation MFA too. The better approach is to assume a credential will eventually be stolen and build security so that a stolen password, or even a stolen session, isn’t enough to hand over the keys. 

And please, for everyone’s sake, go look at that MFA exception list.

Not Sure Where Your Side Doors Are?

Finding them is our day job, and the pen test is just where it starts. CISO Global can help identify and close those gaps in several ways: 

• Penetration Testing. We go after your login portals, reset workflows, and help desk the same way an attacker would, so you find the weak link before they do. 
• SurfaceWatch™. A pen test is a snapshot. SurfaceWatch keeps watching your external attack surface, flagging the forgotten login portals, VPN gateways, and legacy mail endpoints you’ve exposed to the internet before someone starts spraying Fall2026! at them. 
• Risk and Gap Assessments. A hard look at your MFA coverage, exception lists, conditional access policies, and recovery processes, with a prioritized list of what to fix first. 
• vCISO. Experienced security leadership to own the roadmap, from rolling out phishing-resistant authentication to writing help desk verification policies people actually follow. 
• Managed XDR and  AI-Powered SOC. Our analysts watch for the after-login warning signs, like impossible travel, new forwarding rules, and odd token use, and respond at 2 a.m. on a Saturday so you don’t have to. 

Whichever door you want to start with, let’s talk.