The “AiTM” Bypass: Why Standard MFA is No Longer a Legal Safety Net

Article summary: MFA bypass for law firms is now common because AiTM phishing can steal session tokens after a user completes MFA. Standard MFA still helps, but it’s no longer a complete safety net against session theft and prompt abuse. Phishing-resistant sign-in, session-aware controls, and active monitoring turn MFA back into meaningful protection for client data.

It’s the kind of moment that makes law firms feel safe.

An attorney signs in, gets the MFA prompt, approves it, and moves on. The system did what it was supposed to do. The login was “secure.”

Then the uncomfortable question shows up later, usually after an inbox rule appears, a client email goes missing, or a wire change request looks a little too polished: How did someone get in if MFA worked?

That’s the reality behind MFA bypass for law firms. 

Standard MFA still blocks a lot of attacks, but it’s no longer a complete safety net. Some phishing attacks don’t fight MFA at all. They let you complete it, then steal the authenticated session and reuse it.

What “AiTM” Means

AiTM stands for Adversary-in-the-Middle. It’s a phishing attack designed to sit between your user and the real login page, often as a reverse proxy that looks and behaves legitimately.

Here’s the key difference from “classic” phishing: the goal isn’t just to steal a password. The goal is to steal the session created after a successful login.

In a typical AiTM flow, the user clicks a link, lands on a look-alike sign-in page, and enters their credentials. The attacker’s infrastructure relays that login to the real service in real time. When the real service prompts for MFA, the user completes it. Everything feels normal, because the login is actually happening.

But behind the scenes, the attacker captures the session cookie/token that proves the user is already authenticated. With that token, the attacker can often reuse the session from their own device without needing the password again. 

That’s the heart of MFA bypass for law firms. The attacker isn’t beating MFA. They’re stepping around it by stealing what MFA helped create.

This is also why modern phishing often stacks tactics like QR lures, AI-written messages, and MFA bypass techniques. It’s designed to get a real login, not just a click. 

Why Standard MFA Is No Longer a Safety Net

Standard MFA (SMS codes, one-time codes, push prompts) is still worth having. It stops a huge number of credential-stuffing and password-only attacks. But it’s no longer a guaranteed safety net because AiTM attacks are built for environments where MFA is already turned on.

Microsoft’s research on the Tycoon2FA phishing platform describes this at scale. The kit relays the real sign-in flow, presents the real MFA prompt, and then captures the session cookie after MFA succeeds. The attacker can then use that authenticated session to access the account even if the password is later changed. 

Microsoft’s Entra team also notes that AiTM phishing is rising, reporting a 146% increase over the prior year based on their detections. 

And this isn’t just a Microsoft viewpoint. CISA has warned that tools like Evilginx can be used to bypass non-phishing-resistant MFA by capturing and replaying session tokens. 

What Actually Works Against AiTM

AiTM attacks succeed when they can steal the authenticated session. So the defenses have to be phishing-resistant and session-aware.

1.) Move to phishing-resistant sign-in

Passkeys are the most effective solution available against AiTM-style phishing because they’re designed to authenticate to the real domain, not a look-alike proxy. 

In practice, this means prioritizing passkeys/security keys for high-risk accounts first, then expanding.

2.) Add session controls

AiTM is a session theft problem, so you need controls that detect and restrict risky sessions. 

Microsoft’s guidance on evolving identity attacks emphasizes using Conditional Access and risk signals to respond to suspicious sign-ins and potential token theft attempts. It also points to tightening who can register authentication methods and limiting risky flows. 

For a small firm, that can look like: blocking sign-ins from impossible locations, requiring compliant devices for sensitive apps, and forcing reauthentication when risk is high.

3.) Make MFA prompts harder to abuse

Even outside AiTM, attackers still lean on approval pressure. Push-bombing is a common tactic: repeated prompts until someone clicks approve out of frustration or distraction. 

IT professionals suggest implementing practical protections like tightening MFA settings, reducing prompt fatigue, and training users to deny/report unexpected prompts. 

This matters because “standard MFA” fails both ways. It can be socially engineered, and it can be bypassed via session theft.

4.) Treat identity as an operational system

The fastest way AiTM becomes a real incident is when nobody notices the strange session for days. You need monitoring for unusual sign-ins, new inbox rules, new OAuth consents, and unexpected device registrations. You also need a clear response playbook to revoke sessions and reset credentials quickly.

This is where ongoing managed IT and security support matters for law firms. Access control, monitoring, training, and response readiness aren’t one-time projects.

Protect Client Data at the Identity Layer

Email and cloud access are where client confidentiality lives day to day. That’s why MFA bypass for law firms is such a serious issue: it turns a “successful” MFA login into a session theft problem that can look normal until damage is done.

If you want help tightening identity controls and reducing AiTM exposure without slowing attorneys down, contact Digital Crisis. We’ll review your current MFA setup, identify the biggest session risks, and build an upgrade plan your firm can actually follow.

Article FAQs

What is an AiTM phishing attack?

AiTM (adversary-in-the-middle) phishing is a type of attack where the attacker sits between the user and the real login page. The user signs in and completes MFA, but the attacker captures the authenticated session token/cookie. That session can then be reused to access the account.

Can hackers bypass MFA even if I approved the right prompt?

Yes. Some AiTM attacks don’t need you to approve the “wrong” prompt. They relay the real sign-in flow and capture the session after MFA succeeds, which can allow access without triggering MFA again.

What’s the difference between MFA and phishing-resistant MFA?

Standard MFA adds a second step (code or push approval) but can still be bypassed by session theft or prompt fatigue. Phishing-resistant MFA (like passkeys or security keys) is designed to authenticate to the real site and is much harder to proxy and replay in an AiTM attack.