APT42G1044 ↗
Has intercepted SMS-based one-time passwords and has set up two-factor authentication.1 Additionally, APT42 has used cloned or fake websites to capture MFA tokens.2
tfMITRE ATT&CK technique
Multi-Factor Authentication Interception T1111
- Tactic
- Credential Access
- Platforms
- Linux, macOS, Windows
- Version
- 2.1
- Created
- 31 May 2017
- Last modified
- 12 May 2026
- Contributor
- John Lambert, Microsoft Threat Intelligence Center
Adversaries may target multi-factor authentication (MFA) mechanisms, (i.e., smart cards, token generators, etc.) to gain access to credentials that can be used to access systems, services, and network resources. Use of MFA is recommended and provides a higher level of security than usernames and passwords alone, but organizations should be aware of techniques that could be used to intercept and bypass these security mechanisms.
ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact
4
Threat groups70th pct
Threat groups70th percentile · 70% of ATT&CK techniques have this many threat groups attributed or fewer.2
CampaignsTop 17%
Campaigns83rd percentile · 83% of ATT&CK techniques have this many campaigns recorded or fewer.3
Tools & malware57th pct
Tools & malware57th percentile · 57% of ATT&CK techniques have this many tools implementing them or fewer.0
Detection rulesNone recorded
Detection rulesNone recorded · 33% of ATT&CK techniques have none either.Multi-Factor Authentication Interception MITRE reference T1111
70th pctamong all ATT&CK techniques for number of groups
4 groups have been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.
LAPSUS$G1004 ↗
Has replayed stolen session token and passwords to trigger simple-approval MFA prompts in hope of the legitimate user will grant necessary approval.1
ChimeraG0114 ↗
Has registered alternate phone numbers for compromised users to intercept 2FA codes sent via SMS.1
KimsukyG0094 ↗
Has used a proprietary tool to intercept one time passwords required for two-factor authentication.1
All 4 groups for this technique
2 campaigns have been recorded using this technique. Listed newest first; dates are year-granularity and attribution is MITRE’s.
Leviathan Australian IntrusionsC0049 ↗
Leviathan abused compromised appliance access to collect multifactor authentication token values during Leviathan Australian Intrusions.1
Operation WocaoC0014 ↗
During Operation Wocao, threat actors used a custom collection method to intercept two-factor authentication soft tokens.1
All 2 campaigns for this technique
3 software entries are documented implementing this technique. MITRE files each as a tool or as malware; newest first, then by how many groups carry them.
evilginx2S9003 ↗
Can intercept authentication tokens to enable bypass of non-phishing resistant forms of MFA.1
SLOWPULSES1104 ↗
Can log credentials on compromised Pulse Secure VPNs during the DSAuth::AceAuthServer::checkUsernamePasswordACE-2FA authentication procedure.1
SykipotS0018 ↗
Is known to contain functionality that enables targeting of smart card technologies to proxy authentication for connections to restricted network resources using detected hardware tokens.1
All 3 software entries for this technique
Offense vs defense T1111
Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.
Multi-Factor Authentication Interception detection strategy DET0246
MITRE names one behaviour worth catching for this technique and breaks it into 3 analytics, one per platform. Each carries the log sources it needs and the fields you tune per environment.
Detection Strategy for MFA Interception via Input Capture and Smart Card Proxying
3 platforms
AN0687 · Windows
Behavior chain involving unexpected API calls to capture keyboard input, driver loads for keyloggers, or remote use of smart card authentication via logon sessions not initiated by local user interaction
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Process AccessDC0035 | WinEventLog:Sysmon | EventCode=10 |
| Windows Registry Key ModificationDC0063 | WinEventLog:Sysmon | EventCode=13, 14 |
| Logon Session CreationDC0067 | WinEventLog:Security | EventCode=4624, 4648 |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| AccessMask | Tunable based on what memory-level access the keylogger uses (e.g., 0x10 for read) |
| ProcessNameExclusions | Legitimate accessibility tools may use similar API calls (e.g., Magnifier.exe) |
| TimeWindow | Define how quickly access + registry mod + smart card use must co-occur |
AN0688 · Linux
Detection of unauthorized keylogger behavior through access to /dev/input, loading kernel modules (e.g., via insmod), or polling user input devices from non-user shells
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Process AccessDC0035 | linux:syslog | syscalls (open, read, ioctl) on /dev/input or /proc/*/fd/* |
| Driver LoadDC0079 | linux:syslog | dmesg or syslog for module loads |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| PathTarget | Can tune based on device paths accessed for keyboard input (e.g., /dev/input/event0) |
| UserContext | Exclude root or admin-auth shell sessions if needed |
| ModuleWhitelist | Set a known list of allowed kernel modules |
AN0689 · macOS
Processes accessing TCC-protected input APIs or polling HID services without user interaction, or dynamically loaded keylogging frameworks using accessibility privileges
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| OS API ExecutionDC0021 | macos:unifiedlog | com.apple.securityd, com.apple.tccd |
| Process CreationDC0032 | macos:osquery | query: process_events, launchd, and tcc.db access |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| AccessibilityAPIUsage | Detection of programs requesting access to input monitoring (e.g., CGEventTap) |
| TCCBypassAttempt | Alert if TCC settings are altered or bypassed |
| SignedBinaryCheck | Tunable based on developer signing status (legitimate software vs unsigned) |
User TrainingM1017
Remove smart cards when not in use.