MFA Locked the Front Door. Attackers Found the Garage.

This advisory explains that while MFA reduces straightforward password theft, attackers increasingly bypass authentication via MFA relays, push‑fatigue prompts, help‑desk social engineering, stolen sessions and infostealer malware; it recommends moving high‑risk accounts to phishing‑resistant auth (FIDO2/passkeys), hardening recovery and help‑desk workflows, removing legacy exceptions, applying conditional access, and actively monitoring post‑login activity.