[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:mitre-attack\u002Ft1111":3},{"item":4,"lessons":18,"controls":40,"related":63},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":13,"official_url":14,"link_label":15,"note":16,"updated_at":17},"mitre-attack","t1111","T1111","Multi-Factor Authentication Interception",5,"MITRE","**What attackers do.** Attackers intercept or bypass multi-factor authentication, for example by capturing one-time codes through malware or proxy phishing pages, hijacking SMS, or abusing smart card access on a compromised host. This serves the Credential Access tactic.\n\n**How to defend.** Use phishing-resistant MFA such as FIDO2 security keys or platform authenticators, and avoid SMS and voice codes for sensitive access. Protect endpoints from malware and monitor MFA registration and use. Make sure SIM swap protections are enabled with mobile carriers for staff in sensitive roles.\n\n**Signs to look for.** Look for MFA codes used from locations different from the user's device, sign-ins immediately after visits to suspicious domains, SIM swap reports and new MFA methods registered. A common gap is treating any MFA as equal, when one-time codes can be relayed.","Adversaries may target multi-factor authentication (MFA) mechanisms, (i.e., smart cards, token generators, etc.) to gain access to credentials that can be used to access systems, services, and network resources. Use of MFA is recommended and provides a higher level of security than usernames and passwords alone, but organizations should be aware of techniques that could be used to intercept and bypass these security mechanisms. \n\nIf a smart card is used for multi-factor authentication, then a keylogger will need to be used to obtain the password associated with a smart card during normal use. With both an inserted card and access to the smart card password, an adversary can connect to a network resource using the infected system to proxy the authentication with the inserted hardware token. \n\nAdversaries may also employ a keylogger to similarly target other hardware tokens, such as RSA SecurID. Capturing token input (including a user's personal identification code) may provide temporary access (i.e. replay the one-time passcode until the next value rollover) as well as possibly enabling adversaries to reliably predict future authentication values (given access to both the algorithm and any seed values used to generate appended temporary codes).","© The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation (MITRE ATT&CK®).","https:\u002F\u002Fattack.mitre.org\u002Ftechniques\u002FT1111\u002F","Open the technique on MITRE ATT&CK",null,"2026-10-18T15:18:43.664+00:00",{"total":9,"list":19},[20,24,28,32,36],{"slug":21,"title":22,"published_at":23},"fake-ai-chatbot-sites-harvest-mfa-codes-via-browser-in-browser-phishing","Fake AI Chatbot Sites Harvest MFA Codes via Browser-in-Browser Phishing","2026-10-06T16:21:11.157+00:00",{"slug":25,"title":26,"published_at":27},"passkey-phishing-campaigns-harvest-microsoft-365-credentials-and-session-tokens","Passkey-Phishing Campaigns Harvest Microsoft 365 Credentials and Session Tokens","2026-09-11T18:20:23.292+00:00",{"slug":29,"title":30,"published_at":31},"russian-hackers-exploit-zimbra-zero-click-xss-to-steal-email-mfa-tokens","Russian Hackers Exploit Zimbra Zero-Click XSS to Steal Email & MFA Tokens","2026-07-23T18:20:44.189+00:00",{"slug":33,"title":34,"published_at":35},"forg365-phaas-exploits-device-code-auth-and-aitm-to-hijack-microsoft-365-sessions","Forg365 PhaaS Exploits Device Code Auth and AitM to Hijack Microsoft 365 Sessions","2026-07-13T14:20:40.536+00:00",{"slug":37,"title":38,"published_at":39},"vishing-campaign-harvests-microsoft-365-credentials-via-fake-entra-id-pages","Vishing Campaign Harvests Microsoft 365 Credentials via Fake Entra ID Pages","2026-07-10T12:21:50.89+00:00",[41,45,49,54,59],{"slug":42,"name":43,"problem":44,"stories":9},"email-security","Email security","Phishing, malware and invoice fraud are filtered out before they reach inboxes.",{"slug":46,"name":47,"problem":48,"stories":9},"phishing-resistant-mfa","Phishing-resistant MFA","A stolen password, or a user who taps Approve on a push prompt, is no longer enough to log in.",{"slug":50,"name":51,"problem":52,"stories":53},"security-awareness-training","Security awareness training and phishing simulation","People recognise and report attacks instead of falling for them.",3,{"slug":55,"name":56,"problem":57,"stories":58},"patch-management","Automated patch management","Known holes get closed in days, not months.",1,{"slug":60,"name":61,"problem":62,"stories":58},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",[64,69,75,80,85,89,93,97],{"family":65,"item":66,"code":67,"title":68,"together":9},"gdpr","32","Article 32","Security of processing",{"family":70,"item":71,"code":72,"title":73,"together":74},"cis","14","Control 14","Security Awareness and Skills Training",4,{"family":76,"item":77,"code":78,"title":79,"together":74},"nist-800-53","ac-17","AC-17","Remote Access",{"family":81,"item":82,"code":83,"title":84,"together":74},"nist-sp","800-63","SP 800-63","SP 800-63: Digital Identity Guidelines",{"family":70,"item":86,"code":87,"title":88,"together":74},"6","Control 6","Access Control Management",{"family":76,"item":90,"code":91,"title":92,"together":53},"ac-2","AC-2","Account Management",{"family":76,"item":94,"code":95,"title":96,"together":53},"si-3","SI-3","Malicious Code Protection",{"family":70,"item":98,"code":99,"title":100,"together":101},"4","Control 4","Secure Configuration of Enterprise Assets and Software",2]