Use Case: Identity
MFA bypass detection
The user completed MFA. The attacker's evilginx2 proxy intercepted the session cookie in transit. Now they're logged in from Amsterdam while the user is in Toronto. ManySignal sees both sessions.
Why MFA doesn't stop the session from being stolen
MFA authenticates the login — not the session. After a successful MFA verification, the IdP issues a session token. That token is what grants access to resources. Adversary-in-the-middle proxies sit between the user and the IdP, transparently forwarding all traffic — including the MFA exchange — while capturing the resulting session token for the attacker's use. From the IdP's perspective, everything was legitimate.
Detection requires monitoring not the authentication event, but the subsequent session usage: does the device fingerprint, IP, and geographic location match what was used during authentication? A session replayed from a different machine in a different country within seconds of authentication is the unmistakable signature of AiTM bypass.
rule: mfa_bypass_aitm
type: session_fingerprint_delta
trigger:
- condition: |
session.post_auth_ip != session.auth_ip
AND session.post_auth_device_fp != session.auth_device_fp
AND time_delta(auth_event, first_api_call) < 30s
enrichments:
- aitm_infra: evilginx_domain_db, phishing_kit_certstream
- phishing_resistant_check: fido2_enrolled(user)
- session_scope: all_apps_using_this_token
mitre: T1111 (Multi-Factor Authentication Interception)MITRE ATT&CK mapping
MFA bypass FAQ
What MFA bypass techniques does ManySignal detect?
ManySignal detects: AiTM proxy interception (evilginx2, Modlishka, Caffeine), SS7 interception of SMS OTP, SIM swap attacks (inferred from carrier change events), authenticator app cloning indicators, and legacy protocol authentication that sidesteps MFA enforcement. Each technique has a distinct behavioral signature.
Does this detection work when MFA bypass succeeds silently?
Yes. When an AiTM proxy successfully bypasses MFA, the resulting session has a different device fingerprint than the one used at authentication time. ManySignal detects this session fingerprint delta as the primary bypass signal — it fires even when the authentication event itself looks legitimate.
What's the difference between MFA bypass and MFA fatigue?
MFA fatigue is social engineering — the user is tricked into approving a push notification. MFA bypass is technical interception — the OTP or session cookie is stolen in transit without user interaction. Both result in attacker access, but the detection signals and response playbooks differ significantly.
Can phishing-resistant MFA (FIDO2/WebAuthn) be bypassed?
FIDO2 keys are bound to the relying party domain, making them immune to AiTM proxy attacks. ManySignal recommends FIDO2 as the MFA method of choice and tracks which users are enrolled on phishing-resistant vs. phishable MFA. The bypass detection focuses on non-FIDO2 MFA sessions.
Detect MFA bypass before the attacker reaches the inbox
Session fingerprint delta detection catches AiTM attacks regardless of MFA method.