APT42G1044 ↗
Has intercepted SMS-based one-time passwords and has set up two-factor authentication.1 Additionally, APT42 has used cloned or fake websites to capture MFA tokens.2
tfMITRE ATT&CK technique
Multi-Factor Authentication Interception T1111
- Tactic
- Credential Access
- Platforms
- Linux, macOS, Windows
- Version
- 2.1
- Created
- 31 May 2017
- Last modified
- 12 May 2026
- Contributor
- John Lambert, Microsoft Threat Intelligence Center
Adversaries may target multi-factor authentication (MFA) mechanisms, (i.e., smart cards, token generators, etc.) to gain access to credentials that can be used to access systems, services, and network resources. Use of MFA is recommended and provides a higher level of security than usernames and passwords alone, but organizations should be aware of techniques that could be used to intercept and bypass these security mechanisms.
ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact
4
Threat groups70th pct
Threat groups70th percentile · 64% of ATT&CK techniques have fewer threat groups attributed.2
CampaignsTop 17%
Campaigns83rd percentile · 73% of ATT&CK techniques have fewer campaigns recorded.3
Tools & malware57th pct
Tools & malware57th percentile · 51% of ATT&CK techniques have fewer tools implementing them.0
Detection rulesNone recorded
Detection rulesNone recorded · 32% of ATT&CK techniques have none either.