MFA Bypass Explained By Ex-FBI Agent: How Identity Attacks Evade Detection

How do attackers bypass MFA and compromise an organization without deploying malware? Devon Ackerman breaks down help-desk social engineering, stolen session tokens, and adversary-in-the-middle phishing.Security and DFIR leaders will learn why identity-based intrusions evade traditional detection, where hardware security keys can break the attack chain, and how to limit the blast radius when credentials are compromised.Devon is the Global Head of Digital Forensics and Incident Response at Cyber Reason and a former FBI Supervisory Special Agent focused on counterintelligence and cyber investigations. He is also the author of Diving In: An Incident Responder's Journey and one of the most experienced breach investigators working today.Devon explains:◼ Why attackers ditched malware and are stealing identities to hide inside normal user behavior◼ How one phone call to a help desk bypassed MFA and gave full network access without a single alert◼ Why phishing kits intercept your authentication token, not your password◼ Why hardware keys stop most kill chains cold and where that still breaks down◼ The four threat actor categories and why each one requires a different defensive responseTime Stamps(00:00) Devon Ackerman Introduction(01:48) Why digital forensics and incident response belong together(04:28) How modern investigations have changed in the last 5 years(06:49) Are attackers moving faster than defenders?(08:41) Can digital forensics become proactive?(11:31) Will AI turn cyber defense into a war of bots?(14:50) Why security adoption still lags behind new threats(16:43) Identity becomes the primary attack surface(19:56) War story: help desk social engineering, password resets, and disabled MFA(22:52) A real vulnerability exploited within 12 hours(25:18) What happens when CVE-to-exploit timelines shrink to minutes(28:29) How adversary-in-the-middle MFA phishing works(33:16) Why MFA bypass is really about intercepting authentication(35:54) Hardware keys and where phishing kill chains usually stop(39:14) Hacktivists, nation-states, organized crime, and initial access brokers(42:47) The economics of selling access vs exploiting it yourself(46:56) Devon’s final advice for defenders: reduce blast radiusConnect with the speakers ⬇️Devon: https://www.linkedin.com/in/devonackerman/Yegor: https://www.linkedin.com/in/yegor-sak-725330b2/Alex: https://www.linkedin.com/in/alex-paguis-53a21815/Powered by Control D