Multi-factor authentication remains the single highest-impact control in the security stack for most organisations. The MFA bypass techniques that criminal actors are using through 2025 and into May 2026 have matured beyond the SMS-interception era and the security teams that are defending well are doing so with a refreshed understanding of the threat.

Three bypass categories that are active in May 2026:

Adversary-in-the-middle phishing kits. The phishing infrastructure has matured to the point that the criminal kit relays the legitimate authentication flow in real time. The user enters credentials and the MFA code into a malicious page; the kit relays both to the legitimate identity provider; the kit captures the session cookie. The user thinks they have logged in. The attacker has a usable session. This is the dominant production MFA bypass pattern in 2026 and it works against all factor types that produce a code or response that can be relayed within the time window.

MFA fatigue and push-notification spamming. The attack pattern of repeatedly triggering push notifications to a victim’s device until the victim accepts is still active, particularly against organisations where number-matching MFA has not been enabled or where the user training has been weak. The number-matching defence has reduced the success rate of this pattern but it has not eliminated it.

Help-desk and account recovery social engineering. The criminal teams have become more practised at calling the IT help desk, identifying as a target employee, and walking the help desk through a credential or MFA reset. The high-profile incidents of 2023 and 2024 have led to better help-desk training but the practice is still uneven across the mid-market.

What is working in defence:

Phishing-resistant MFA — FIDO2, WebAuthn, hardware keys — is the strongest available defence. The organisations that have deployed phishing-resistant MFA across all administrative accounts and across the senior leadership team have removed the adversary-in-the-middle vector for those accounts. The deployment across general workforce accounts is the work that is still in progress at most mid-market organisations.

Conditional access policies that require device compliance, IP location, or other context for sensitive actions. The session cookie captured by an adversary-in-the-middle kit may not pass the device compliance check, depending on policy configuration. The organisations that have invested in conditional access tuning are seeing better outcomes than the organisations that rely on MFA alone.

Session monitoring and anomaly detection. The organisations that monitor for unusual session behaviour — new device, unusual location, atypical access pattern — are catching the post-bypass intrusion earlier than the organisations that rely on the authentication event alone.

Help-desk and account recovery process hardening. The 2024 and 2025 incident lessons have driven better help-desk verification procedures at the more mature organisations. The pattern of requiring multiple verification factors for any MFA reset and of escalating any unusual reset request to a senior team is increasingly standard.

What is not working as a defence:

SMS-based MFA. The SIM-swap and interception risks have been documented for years. The 2026 reality is that SMS-only MFA is not a defensible position for any organisation with serious threat exposure. The transition off SMS continues to be a major project at organisations with legacy systems.

App-based MFA without phishing-resistance. The Microsoft Authenticator app or the Google Authenticator app generating a six-digit code is better than nothing and worse than phishing-resistant alternatives. The codes are relay-able by adversary-in-the-middle kits and the protective value against the current threat is limited.

User training as the primary defence. The user training is necessary but not sufficient. The 2026 attack patterns are designed to be invisible to even well-trained users. The technical controls are the primary defence; the training supports them.

For Australian security leaders in May 2026, the practical read is that the threat against MFA has matured, the defence requires more than the 2022 generation of MFA, and the migration to phishing-resistant authentication is now an urgent project rather than a planning consideration. The organisations that have completed this migration are well-defended. The organisations that have not are operating with a known vulnerability against a known threat pattern.

The good news is that the tooling for phishing-resistant MFA has matured and the deployment friction has dropped. The hardware keys are cheap. The platform support for WebAuthn is broad. The user experience is acceptable. The remaining work is the operational discipline of deploying it.