Multi-factor authentication remains a foundational control in Australian enterprise security stacks, but the assumption that MFA is sufficient as a backstop has not survived the 2024 and 2025 threat picture. By mid-2026, Australian incident response teams are routinely investigating compromises where MFA was in place and was bypassed.

The patterns are not exotic. They are the same patterns the international threat intelligence community has been publishing about for two years, now reliably reaching Australian organisations.

The current bypass patterns

The dominant MFA bypass patterns Australian incident responders are seeing in 2026 are MFA fatigue (push spam until the user accepts), adversary-in-the-middle phishing (proxying the legitimate authentication session to capture the session token), SIM swap (still a problem despite carrier improvements), and post-authentication session theft via infostealer malware on user endpoints.

The relative frequency has shifted. AITM phishing kits are now broadly accessible to lower-skill attackers, which has driven a meaningful increase in this pattern in Australian incidents. Infostealer malware has continued its trajectory as a major initial access vector. SIM swap remains a problem in specific targeted attacks but is less of a volume issue.

The control responses

The Australian organisations that have hardened against MFA bypass have done so through a combination of controls. Phishing-resistant MFA (FIDO2 hardware tokens or passkeys) for high-value accounts, which is the single most effective control against AITM phishing. Conditional access policies that reduce risk-based authentication tokens. Endpoint detection and response with infostealer-specific detections. Strong session management practices, including short token lifetimes and re-authentication for sensitive actions.

The practical implementation has been uneven. Phishing-resistant MFA is well-understood as a control but the rollout across Australian enterprises has been slower than the threat picture warrants. Several large breach incidents in 2025 and 2026 occurred in organisations where phishing-resistant MFA had been planned but not rolled out for the compromised accounts.

The infostealer problem

The infostealer threat is structurally different from the AITM problem because the attack succeeds before any authentication challenge is reached. The attacker steals the session cookies and tokens from a compromised endpoint and uses them directly.

The response on the Australian enterprise side has been better EDR coverage, better browser security configurations, and tighter session management on critical applications. The response has not solved the problem because the underlying infostealer infrastructure continues to grow.

The user education question

User education against MFA bypass is harder than user education against traditional phishing. AITM phishing presents a perfectly valid-looking authentication flow to the user, and the user behaviour that would have prevented the attack (verifying the URL more carefully than humans naturally do) is hard to enforce. MFA fatigue attacks rely on user fatigue, which is reduced by limits on authentication attempt rates and clear push notification design but not eliminated.

The Australian security community has largely concluded that user education is necessary but insufficient against modern MFA bypass. The technical controls are doing the load-bearing work.

The 18-month outlook

Expect continued growth in AITM phishing kit availability. Expect continued maturation of infostealer infrastructure. Expect continued slow rollout of phishing-resistant authentication. Expect more high-profile Australian incidents that share the same root cause patterns we are already seeing.

For Australian security leaders in 2026: phishing-resistant MFA for high-value accounts is no longer optional. EDR coverage with infostealer-specific detection is no longer optional. Conditional access maturity is no longer optional. The organisations that have not got these in place are exposed.