Overview
Multi-factor authentication (MFA) is one of the most effective security controls available. But it's not a silver bullet — modern info-stealer malware has developed techniques to bypass MFA entirely. This article explains how, and why credential monitoring remains critical even with MFA in place.
How MFA Is Supposed to Work
MFA adds a second factor beyond your password:
- You enter your password (something you know)
- You provide a second factor: a code from an authenticator app, a push notification, a hardware key, or an SMS code (something you have)
- Only after both factors are verified does the service grant access
This makes stolen passwords alone insufficient for unauthorized access.
How Stealers Bypass MFA
Session Cookie Theft
The most common MFA bypass technique uses stolen session cookies:
- A user logs in to a service with MFA — everything is legitimate
- The service creates a session cookie in the user's browser to maintain their authenticated state
- Info-stealer malware extracts this session cookie along with everything else
- The attacker imports the stolen cookie into their own browser
- The service sees a valid session — no password or MFA prompt is required
The attacker effectively inherits the user's already-authenticated session.
Token and Seed Theft
Some advanced stealers also target:
- Authenticator app data — seeds or secrets used to generate TOTP codes
- Browser extension data — 2FA extension storage
- Password manager vaults — if the vault is unlocked when the stealer runs
Real-World Impact
Session cookie theft has been used in high-profile attacks against:
- Major technology companies (bypassing Google, Microsoft, and Okta MFA)
- Government agencies
- Corporate VPN and remote access systems
- Cloud admin consoles (AWS, Azure, GCP)
What This Means for Your Organization
Even if you have MFA deployed everywhere:
| Scenario | MFA Protection |
|---|---|
| Attacker uses a password from an old breach | ✅ Blocked |
| Attacker has the password but no second factor | ✅ Blocked |
| Attacker replays a stolen session cookie | ❌ Bypassed |
| Attacker has both the password and the authenticator seed | ❌ Bypassed |
Defense-in-Depth Strategy
MFA is essential but must be part of a layered security approach:
- MFA — deploy everywhere, prefer hardware keys and authenticator apps over SMS
- Credential monitoring — detect when employee credentials appear in stealer logs before they're used
- Endpoint detection (EDR/XDR) — identify and block info-stealer malware on devices
- Session management — implement session timeouts, geographic restrictions, and anomalous session detection
- Conditional access — require step-up authentication for sensitive actions or unusual contexts
- Employee training — educate staff about malware risks, especially from personal devices
The Role of Credential Monitoring
Credential monitoring (like Verusight) serves as an early warning system:
- If an employee's credentials appear in a stealer log, their session cookies may also be compromised
- Detecting the credential leak enables you to revoke sessions and force re-authentication before attackers can use stolen cookies
- Without monitoring, you have no visibility into session cookie theft until an actual unauthorized access event occurs