Identity Attacks in 2026: Credential Theft, Session Hijacking and MFA Bypass

Hero Summary

As organizations move to cloud and SaaS, a login is increasingly the perimeter: whoever holds a valid identity can reach the data. Attackers therefore target identity directly — stealing passwords, tricking users into approving logins, intercepting session tokens, and manipulating help desks. Multi-factor authentication (MFA) raises the bar, but not all MFA is equal. CISA ranks FIDO/WebAuthn as the only widely available phishing-resistant method, and its guidance recommends phishing-resistant MFA particularly for webmail, VPNs, and accounts that access critical systems. This guide explains the main identity attack techniques and the controls that counter each.

Executive Summary

Verizon's 2026 Data Breach Investigations Report finds that stolen passwords are now the runner-up to software vulnerabilities as the way breaches begin, and the FBI's 2025 report notes a rise in account takeover (ATO) cases, with some incidents involving 50 or more simultaneous transfers to accounts at multiple banks. This guide covers credential theft and reuse, push-notification fatigue, SIM swapping, adversary-in-the-middle phishing that captures session tokens, help-desk social engineering, and what to do about each. It closes with a prioritised action list and how Threat ResQ's products relate.

Why identity is the target {#why}

A valid login lets an attacker act as a legitimate user, which makes their activity harder to distinguish from normal use, and cloud services are reachable from anywhere. Attackers also find identity attacks efficient: a single phished credential can open email, file storage, and business applications. The FBI's 2025 report observes that in its Financial Fraud Kill Chain work, the process saw a rise in tech support and account takeover initiations, and that ATO-related incidents can contain upwards of 50 or more transactions to different recipient accounts at multiple banks happening simultaneously.

Credential theft and reuse {#credentials}

Passwords reach attackers through:

• Phishing, where users enter credentials on fake pages. See Phishing Attacks: Types, Warning Signs & Prevention.
• Infostealer malware on infected devices that harvests saved passwords and browser data.
• Data breaches at other services, since people reuse passwords.
• Credential stuffing, where attackers automatically try leaked username-and-password pairs against other sites.

Counter: unique passwords through a password manager, MFA everywhere, checks against known-breached passwords, and protection against malware on endpoints.

MFA fatigue and push bombing {#fatigue}

In a push-bombing attack, the attacker already has the password and repeatedly triggers MFA approval prompts, hoping the user will eventually approve one to make the notifications stop, or will approve one without checking. CISA's guidance lists push bombing among the threats that weaker forms of MFA are susceptible to, and recommends number matching — where the user must enter a number shown on the login screen — as an interim control for organizations that cannot yet adopt phishing-resistant MFA.

Counter: number matching, rate limits on prompts, alerts on repeated denied prompts, and training people to report unexpected prompts rather than approve them.

SIM swapping and SMS interception {#sim}

SMS and voice codes can be intercepted or redirected, including through SIM swapping, where an attacker convinces a mobile carrier to move a victim's number to a SIM they control. CISA's ranking places SMS and voice codes at the weak end of MFA methods, and its cross-sector performance goals list SMS or voice only for use when no other options are possible.

Counter: move away from SMS codes, especially for administrators, executives, and finance, towards authenticator apps with number matching and then phishing-resistant methods.

Adversary-in-the-middle phishing and session theft {#aitm}

Adversary-in-the-middle (AiTM) phishing uses a fake login page that proxies the real service in real time. The user enters their password and completes MFA on what looks like the genuine site; the attacker relays both and captures the resulting session token or cookie, which proves a login already happened. With that token the attacker can access the account without needing the password or MFA again until the session expires or is revoked. Infostealer malware can also steal session tokens from a device.

CISA's guidance on phishing-resistant MFA explains why FIDO/WebAuthn counters this: when a malicious actor tricks a user into logging in to a fake website, the FIDO protocol will block the attempt, because the credential is bound to the genuine site.

Counter: phishing-resistant MFA (FIDO/WebAuthn security keys and passkeys), short session lifetimes for sensitive applications, re-authentication for high-risk actions, device-compliance checks, and monitoring for impossible travel and unusual token use. Revoke sessions immediately after any suspected compromise.

Help-desk and recovery abuse {#helpdesk}

Attackers often target the human process around identity: calling the help desk while impersonating an employee to reset a password or register a new MFA device. CISA's Scattered Spider advisory (AA23-320A) recommends that organizations require phishing-resistant MFA for all services to the extent possible, particularly for webmail, VPNs, and accounts that access critical systems.

Counter: strict identity verification for resets, call-back to a number on file, manager approval for privileged changes, delays and notifications on new MFA registrations, and training for support staff. See Smishing and Vishing.

Not all MFA is equal {#mfa}

According to CISA's fact sheet on implementing phishing-resistant MFA:

Method	Phishing resistance
FIDO / WebAuthn (security keys, passkeys)	Strongest — the only widely available phishing-resistant method
PKI-based (smart card or certificate)	Phishing-resistant, but needs mature identity management
App-based code or push with number matching	Moderate; best option for small and medium businesses that cannot yet adopt phishing-resistant MFA
SMS or voice codes	Weakest; use only when nothing else is possible

See also Email Account Security Beyond Passwords.

Controls that counter each technique {#controls}

Technique	Primary controls
Credential theft and reuse	Password manager, unique passwords, breached-password checks, endpoint protection
MFA fatigue	Number matching, prompt rate limits, alerts, training
SIM swap and SMS interception	Replace SMS codes with app-based or phishing-resistant MFA
AiTM and session theft	Phishing-resistant MFA, short sessions, token and device controls, monitoring
Help-desk abuse	Verification procedures, call-back, approval and notification for MFA changes
Privilege abuse after compromise	Least privilege, privileged access management, separate admin accounts

If an account is compromised {#response}

1. Revoke active sessions and tokens, not only reset the password.
2. Reset credentials and re-register MFA from a trusted device.
3. Check for persistence — new MFA devices, forwarding rules, delegated access, OAuth app consents.
4. Review activity — sign-ins, sent mail, file access, and data downloaded.
5. Warn contacts who may have received fraudulent messages.
6. Investigate how it happened and fix the gap. For serious incidents, engage incident response.

Priority actions {#priorities}

1. Move administrators, executives, and finance to phishing-resistant MFA first.
2. Replace SMS and voice codes wherever possible; enable number matching on push approvals.
3. Harden help-desk verification and MFA-change workflows.
4. Shorten session lifetimes for sensitive applications and require re-authentication for high-risk actions.
5. Monitor sign-ins for anomalies, and make it easy for staff to report unexpected prompts.
6. Protect endpoints against infostealer malware.
7. Train users on fake login pages and approval prompts.

How Threat ResQ fits {#threat-resq-fit}

• TRISA and TRAP address the human side: adaptive awareness training and phishing, smishing, and vishing simulation, including the fake-login and impersonation scenarios used in identity attacks.
• SOC+, Threat ResQ's managed detection and response platform, provides 24x7 monitoring and alert triage with correlated detection across endpoint, network, and identity signal.
• The VAPT service tests applications, including authentication and session handling, and the Incident Response service supports containment and recovery.

FAQ {#faq}

What is an MFA bypass attack? An attack that defeats multi-factor authentication without breaking its cryptography — for example, by overwhelming a user with approval prompts, redirecting SMS codes through a SIM swap, or capturing a session token through a fake login page.

What is MFA fatigue or push bombing? Repeatedly sending login approval prompts to a user who has had their password stolen, in the hope that they approve one. Number matching, where the user must enter a number shown on the login screen, is a recommended interim control.

What is the strongest form of MFA? Per CISA, FIDO/WebAuthn (security keys and passkeys) is the only widely available phishing-resistant method, because the credential is bound to the genuine website and will not work on a fake one.

What is session hijacking? Stealing a valid session token or cookie so an attacker can access an account without logging in again — through adversary-in-the-middle phishing pages or infostealer malware on a device.

What should I do first if I suspect an account is compromised? Revoke active sessions and tokens as well as resetting the password, re-register MFA from a trusted device, check for forwarding rules and unauthorized devices or app consents, and review activity.