MFA Bypass: The New Attack on Finance

The financial services sector is experiencing a significant shift in cyber threats, with attackers increasingly bypassing traditional security measures like multi-factor authentication (MFA). Reports indicate that threat actors are not focusing on phishing passwords, but are instead using voice phishing over platforms like Microsoft Teams to trick employees into resetting MFA credentials. This allows them to register their own devices and gain network access.

This trend is confirmed by multiple independent reports. CrowdStrike's 2026 Financial Services Threat Landscape Report identified voice phishing as the primary technique for the most active threat group, Mutant Spider. Concurrently, the FBI warned about Kali365, a phishing-as-a-service platform enabling token theft through legitimate authentication flows. The Verizon 2026 Data Breach Investigations Report also noted that vulnerability exploitation has overtaken credential theft as the leading initial access vector for breaches.

E-crime actors are driving a majority of these intrusions, with ransomware operators posting a significant increase in financial services victims. State-sponsored groups are also escalating their activities, targeting identity and access management systems. The speed and sophistication of these attacks, often exploiting legitimate authentication processes, are outpacing traditional defense models.

Security leaders are advised to re-evaluate what MFA truly protects and where future investments should be directed. The focus is shifting from solely preventing password theft to addressing the new attack surfaces that allow MFA bypass, such as social engineering help desk calls and the exploitation of authentication flows.