Multi-factor authentication is still the single most useful defensive control most organisations can deploy. It’s also less protective in 2026 than it was when many organisations rolled it out three to five years ago. The bypass techniques have matured, and defenders relying on the protection assumptions of 2021-22 are increasingly exposed.

The dominant bypass pattern in 2026 is adversary-in-the-middle phishing combined with session token theft. The user receives a credible-looking phishing email, clicks a link that proxies through the attacker infrastructure to the real authentication endpoint, completes the MFA challenge legitimately, and the attacker captures the resulting session cookie. The attacker then replays the session against the target service. From the user’s perspective, nothing seemed wrong. From the service’s perspective, an authenticated session was established. From the SOC’s perspective, the activity looks like normal authenticated user behaviour until something downstream raises a flag.

This pattern works against TOTP-based authenticator apps (Authy, Google Authenticator, Microsoft Authenticator’s basic OTP mode). It works against SMS OTP, which has been deprecated for high-security use cases for years but remains widely deployed in second-tier accounts. It works against push-notification-based MFA when the user approves the prompt because they recently entered credentials.

It does not work, or works much less reliably, against phishing-resistant authentication: FIDO2 security keys, platform passkeys, and properly-implemented Windows Hello for Business with Conditional Access policies. The cryptographic binding between the authenticator and the legitimate origin breaks the AITM proxy pattern. The combination of phishing-resistant MFA on high-value accounts and conditional-access policies that require it for specific operations is the configuration that demonstrably resists the 2026 phishing capability.

A second bypass pattern that’s grown in 2026: MFA fatigue / push bombing combined with social engineering. The attacker initiates authentication to the target service repeatedly, generating a stream of push notifications to the victim’s authenticator. Eventually the victim approves one — out of frustration, mistake, or because they’ve been social-engineered into believing the prompts are legitimate IT activity. The mitigation here is number-matching push notifications, which most major MFA vendors now support. Number matching makes the bombing pattern much less effective because the user has to actively enter a number rather than just tap approve.

Number matching uptake is uneven. Organisations that completed the rollout of number matching across their MFA estate in 2024-25 are well-positioned. Organisations that have been slow to deploy it remain exposed to push bombing as a real attack vector. Several recent high-profile incidents involved push bombing as a key component, and the mitigation has been available for over a year. The implementation gap is the issue.

A third pattern: SIM swap attacks against SMS-based MFA. This isn’t new, but the targeting has gotten more sophisticated. Attackers in 2026 increasingly combine OSINT-driven target selection with carrier-side social engineering and insider relationships at telco channels to execute SIM swaps efficiently. The defensive response is straightforward: stop using SMS for any MFA that protects something valuable, and move high-value accounts to phishing-resistant authenticators or app-based push with number matching.

A fourth pattern that’s emerged more visibly in 2026: helpdesk-driven account takeover. The attacker calls the helpdesk, claims to be the target user, and uses social engineering to get the helpdesk to reset MFA enrolment on the target’s behalf. From the attacker’s perspective, this is bypassing MFA by getting helpdesk to enrol attacker-controlled authenticators. The mitigation is rigorous helpdesk verification procedures and tighter audit on MFA enrolment changes. This is procedural, not technical, but it’s where several major 2025 breaches actually started.

A fifth pattern: malware-driven session theft on managed endpoints. Once attackers have an information-stealing malware presence on a target endpoint, they can extract authenticated session tokens directly from the browser session storage. This bypasses MFA entirely because the MFA already happened legitimately and the attacker is just stealing the resulting session. The defence here is endpoint security plus token-binding (where supported) plus credential lifecycle management that limits session lifetime.

The current defensive position that actually works in 2026: phishing-resistant MFA on high-value accounts, number-matching push for any push-based MFA in use, hard-elimination of SMS MFA on anything sensitive, tight helpdesk verification procedures, strong endpoint security, short-lived sessions for sensitive applications, and conditional-access policies that require step-up authentication for high-risk operations. This is meaningfully more work than what most organisations deployed in 2021-22, and the work to upgrade is the work that defenders need to be doing now.

The simple takeaway: MFA is necessary but not sufficient in 2026. The composition of the MFA matters. The procedural controls around it matter. The session and credential lifecycle matters. Organisations doing all of this are reasonably well-defended. Organisations doing only the basics are increasingly exposed.