{"id":70291,"date":"2024-08-28T17:40:41","date_gmt":"2024-08-28T16:40:41","guid":{"rendered":"https:\/\/www.n-able.com\/?p=70291"},"modified":"2025-08-28T10:34:59","modified_gmt":"2025-08-28T09:34:59","slug":"a-threat-actors-playbook-common-techniques-and-how-to-bypass-mfa","status":"publish","type":"post","link":"https:\/\/www.n-able.com\/es\/blog\/a-threat-actors-playbook-common-techniques-and-how-to-bypass-mfa","title":{"rendered":"A Threat Actor\u2019s Playbook: Common Techniques and How to Bypass MFA"},"content":{"rendered":"<div class=\"flex_column_table avia-full-stretch ep-lazy-loaded av-equal-height-column-flextable av-break-at-tablet-flextable flex-column-table-2 \">\n<div class=\"flex_column av_two_third av-break-at-tablet flex_column_table_cell av-equal-height-column av-align-top ep-lazy-loaded avia-builder-el-10 el_after_av_one_sixth el_before_av_one_sixth \">\n<div class=\"flex-column-inner\">\n<section class=\"av_textblock_section \">\n<div class=\"avia_textblock \">\n<p class=\"ai-optimize-8 ai-optimize-introduction\"><span data-contrast=\"auto\">Businesses with a network or email system are dealing with a big problem causing network issues: cybercriminals bypass multifactor authentication (MFA). The threat is not novel, overly complex, engineered, or used exclusively by an Advanced Persistent Threat (APT) but rather a persistent and increasingly easy-to-adopt tactic and exploitation chain attackers are successfully using to potentially devastating effects.\u202f<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><span data-contrast=\"auto\">\u202f<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p>\n<p class=\"ai-optimize-9\"><span data-contrast=\"auto\">The attack chain is simple. A cybercriminal gains access to a user\u2019s credentials to access their email accounts and then sets up automatic inbox rules to hide nefarious emails and any replies from the legitimate user. Then, they use that basic access to further compromise systems and networks or directly affect payments through business email compromise.\u202f<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p>\n<p class=\"ai-optimize-10\"><span data-contrast=\"auto\">At the heart of defense against these attacks is ensuring that only legitimate and verified users can log onto and use these systems. The first step to this is the obvious username and password \u2013 but weak passwords and password reuse add to the ever-growing list of compromised services leaking user account details.\u202f<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p>\n<h2 class=\"ai-optimize-11\"><strong><span>Pitfalls of Over-Reliance on MFA\u00a0<\/span><\/strong><\/h2>\n<p class=\"ai-optimize-12\"><span data-contrast=\"auto\">Administrators often set up MFA or two-factor authentication to harden systems against attacks and help prevent unauthorized access. \u202f<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p>\n<p class=\"ai-optimize-13\"><span data-contrast=\"auto\">Unfortunately, MFA is probably overly valued in today\u2019s security landscape, and the security it grants accounts is perhaps given too much weight as an effective security control. This is not to say that multifactor isn\u2019t a useful control; it is a critical security fundamental for any business system or network. However, the Adlumin Threat Research Team has found that it often gives administrators and security professionals a false sense of security in their authorization controls. MFA is important in securing systems by strengthening authentication but is just one part of the security stack and often on the frontlines of defense for a system. Still, in our experience, security professionals rely too much on MFA protections. <\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p>\n<p class=\"ai-optimize-14\"><span data-contrast=\"auto\">The Adlumin Threat Research and MDR team has seen MFA security controls increasingly being circumvented or bypassed by attackers in the never-ending cat-and-mouse game of security as evidenced by an increasing number of our incident response investigations being underpinned by compromised MFA-protected accounts.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p>\n<h2 class=\"ai-optimize-15\"><strong><span>MFA Implementation Explained\u00a0<\/span><\/strong><\/h2>\n<p class=\"ai-optimize-16\"><span data-contrast=\"auto\">MFA will not always protect users and businesses from attackers gaining access to potentially critical business systems. First, let\u2019s clarify what we mean by Multifactor Authentication, sometimes known as 2FA or 2 Factor Authentication. MFA is when you authenticate \u2013 \u201clogin\u201d \u2013 against a system like a website or service by proving your identity using traditional means of providing something you know, like a username and password, but adding a second source to verify the user.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p>\n<p class=\"ai-optimize-17\"><b><span data-contrast=\"auto\">Here are a few ways MFA is implemented:<\/span><\/b><span data-ccp-props=\"{}\">\u00a0<\/span><\/p>\n<h3 class=\"ai-optimize-18\"><b><span data-contrast=\"auto\">#1 Secure Tokens and Hardware MFA<\/span><\/b><\/h3>\n<p class=\"ai-optimize-19\">One of the first but increasingly relic ways of implementing that second factor is using Secure ID Tokens. For example, this includes the RSA(c) Token on many IT and even regular business users\u2019 keychains next to their car and house keys or attached to a lanyard around their neck. These physical hardware tokens generate a computable, predictable, and reproducible but secure six or so digit number every so often, typically rotating in a range of 10 to 30 seconds. While mathematically predictable, this number requires knowing a secret, which is usually a very large prime number, to predict the next key in the sequence.\u00a0<span data-ccp-props=\"{}\">\u00a0<\/span><\/p>\n<p class=\"ai-optimize-20\"><span data-ccp-props=\"{}\">\u00a0<\/span><span data-contrast=\"auto\">The token or fob (as in key fob, owing to their similar appearance) has that secret built into its components to generate the codes. The other end of the authentication system you\u2019re using has those secret keys for the tokens essentially registered with it so that it can generate the same predictable keys. When logging in, you provide the 6-digit number, and the authentication system compares that to what it expects. If you\u2019ve supplied the correct username and password and then also supplied the correct code from your hardware key, the system checks your credentials, and when the code matches what it expects, it grants you access.\u202f<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><span data-contrast=\"auto\">\u202f<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p>\n<p class=\"ai-optimize-21\"><span data-contrast=\"auto\">This is a somewhat simplified view of how these secure tokens and their codes can work with some abstractions and condensing of the layers and processes involved being taken. Some systems use time-based syncing to ensure that the correct key is generated and checked at the correct time, different cryptography and methods of generating and predicting the code, and even more complex asymmetric cryptographic schemes.\u00a0<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p>\n<h3 class=\"ai-optimize-22\"><b><span data-contrast=\"auto\">#2 Authentication Apps<\/span><\/b><span data-ccp-props=\"{}\">\u00a0<\/span><\/h3>\n<p class=\"ai-optimize-23\"><span data-contrast=\"auto\">The most common way we\u2019ve seen MFA implemented today is through Authentication Apps. These are apps on your phone that tie to whatever service and account you\u2019re trying to access and offer rotating codes used for MFA authentication. The MFA functionality may even be built into its corresponding phone app for some services.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p>\n<p class=\"ai-optimize-24\"><span data-contrast=\"auto\">The issue that the Adlumin Threat Research Team has identified is that organizations have likely become too reliant on the security offered by MFA. Originally, MFA strengthened authentication, could prevent breaches where passwords were compromised and known to attackers, or helping to mitigate brute force attempts against an account trying up to hundreds or thousands of passwords to gain access.\u202f<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p>\n<h2 class=\"ai-optimize-25\"><strong><span>Common MFA Bypass Techniques\u00a0\u00a0<\/span><\/strong><\/h2>\n<p class=\"ai-optimize-26\"><span data-contrast=\"auto\">The early effectiveness of MFA has lulled security practitioners into a trap of over-relying on the control system to prevent unauthorized access. This has become a problem as we have first-hand observed attackers employing a number of attacks meant to bypass MFA.\u202f<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p>\n<h3 class=\"ai-optimize-27\"><b><span data-contrast=\"auto\">Phishing Emails Resulting in Man-in-the-Middle Attacks<\/span><\/b><\/h3>\n<p class=\"ai-optimize-28\">The most common and effective method we see is the use of phishing emails to a target\/user, which results in a man-in-the-middle (MiTM) attack. In this attack, an unwitting user is directed to a site that looks just like the service they are trying to authenticate to, but unbeknownst to them, they\u2019re actually in a secure connection with the attacker who is capturing and relaying any provided credentials to the legitimate site, making this a convincing trick since users see and interact with the page as they expect. Through this, attackers gain an opportunity to access passwords input by the targeted user, intercept second factors like MFA codes, and, most importantly, capture credentials such as authentication tokens or cookies to replay and gain access to an otherwise completely legitimately user authorized session. Essentially, it is hijacking or at least co-opting the user\u2019s granted authorization and access.<\/p>\n<h3 class=\"ai-optimize-29\"><b><span data-contrast=\"auto\">Tools and Frameworks: Evilginx<\/span><\/b><\/h3>\n<p class=\"ai-optimize-30\">Many open-source techniques and frameworks, such as Evilginx, have been developed to support such attacks, which help automate this credential capture through phishing messages, automated deployment of infrastructure needed to support the attack, and the capture of user credentials and sessions.\u202f These tools enable even the lowest skilled attackers to bypass MFA-based security and have lowered the entry barrier before an attacker becomes a serious threat to a targeted organization. Our Threat Research Team demonstrated in a break-out session at this year\u2019s Blackhat conference an example of Evilginx-based attacks enabling MFA bypass enhancing its potency by chaining components with Large Language Model (LLM) usage like ChatGPT, paired with LinkedIn scraping to create an automated framework for generating and delivering targeted spear phishing emails and then scraping user access tokens\/credentials allowing for easy, scalable and importantly targeted attacks.\u202f<span data-ccp-props=\"{}\">\u00a0<\/span><span data-contrast=\"auto\">\u202f<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p>\n<p class=\"ai-optimize-31\"><span data-contrast=\"auto\">The Evilginx MiTM type-attack, underpinned by phishing, leading to user credential compromise, is the most common technique the team has seen used by attackers to bypass MFA protections across industries and business sizes.\u202f<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p>\n<p class=\"ai-optimize-32\"><span data-contrast=\"auto\">In fact, our Threat Research Team has observed cases where users in targeted organizations have bypassed protections in Microsoft 365 online email services meant to prevent users from clicking on suspicious links which may lead these types of attacks. Many businesses use this feature, which is part of Microsoft\u2019s Defender for 365 product and includes phishing link identification and usage prevention and warning, requiring users to manually acknowledge that they are trying to browse the internet to a site that has been labeled as potentially malicious. Despite this, the Threat Research Team has observed specific logs in these types of attacks, the OnClick logs, which indicate users are regularly bypassing these critical warnings.\u202f<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p>\n<p class=\"ai-optimize-33\"><span data-contrast=\"auto\">Th team then observes that shortly after these likely malicious sessions, users\u2019 accounts are then accessed by attackers remotely, likely reusing the session authorization tokens captured by a MitM attack tied to the clicked link. Essentially running either an EvilGinx provided or Evilginx-likely infrastructure to support it. In these attacks, the user is often presented with a site that looks like a legitimate login portal for the service intended to be accessed, such as a Microsoft 365 login page.\u202f<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p>\n<p class=\"ai-optimize-34\"><span data-contrast=\"auto\">A scrupulous user may even notice that the connection to the supposedly legitimate but actually malicious site is secure \u2013 indicated by the now ubiquitous green or gray lock icon typically indicating a secure, encrypted connection using SSL\/TLS technology\/encryption. This offers users a false sense of security as they may believe it means the access is secure. In reality, it\u2019s just the user\u2019s access to the malicious site that is secure, which is where the user\u2019s direct access ends. The malicious server then proxies, or stands in the middle of, a secure connection to the legitimate access endpoint, allowing for snooping of data sent supposedly securely from the user to the end service. With that, the attacker has credentials ready to be replayed, allowing them to reuse the same authorization granted to the legitimate user.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p>\n<h2 class=\"ai-optimize-35\"><strong><span>The Threat Research Team\u2019s Remediation\u00a0<\/span><\/strong><\/h2>\n<p class=\"ai-optimize-36\"><span data-contrast=\"auto\">Luckily, the Adlumin Threat Research Team has prevented multiple potential compromises using this method of MFA bypass, which we believe is the most commonly used technique with the lowest barrier to entry for attackers. This is owed to the methodology\u2019s corpus of information and open-source tools. In these cases, users often bypass the security warning provided in relation to a phishing link, which can result in their credentials being predictably compromised. However, when the attacker goes to access the system using the same credentials or during the portion where they\u2019re proxying the login \u2013 they\u2019re often doing so with different systems or from locations different from the legitimate user which triggers the Adlumin platform&#8217;s various User Entity Behavior Analytics (UEBA) leading to alerting and potential blocking through Security Orchestration Automation and Response (SOAR) actions which can issue commands such as automatic resets of the user\u2019s credentials or locking of the account preventing any malicious access.\u202f<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p>\n<h2 class=\"ai-optimize-37\"><strong><span>Mitigating the Risks of MFA\u00a0<\/span><\/strong><\/h2>\n<p class=\"ai-optimize-38\"><span data-contrast=\"auto\">Security administrators need to be aware of the common usage of these techniques, which have proven effective in the attack chain. They need to monitor for OnClick usage and ensure they\u2019re using advanced detection and alerting systems such as UEBA to detect when these attacks are occurring. Additionally, SOAR capabilities remain critical in preventing such attacks and are arguably becoming more important in the modern cyber battle space where attack and comprise has become an inevitable when vs. if question.\u202f<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p>\n<p class=\"ai-optimize-39\"><strong><a href=\"https:\/\/www.n-able.com\/products\/adlumin-managed-detection-and-response\" target=\"_blank\" rel=\"noopener\">Click here<\/a> to learn more about how the Adlumin Managed Detection and Response Services and Extended Detection and Response can empower your team to illuminate threats, eliminate cyber risk, and command authority.<a href=\"https:\/\/adlumin.com\/contact\/\">\u202f<\/a><\/strong><\/p>\n<\/div>\n<\/section>\n<\/div>\n<\/div>\n<\/div>\n","protected":false},"excerpt":{"rendered":"<p>Protect your business from Evilginx MFA bypass attacks. Learn how Adlumin\u2019s Threat Research Team detects, prevents, and responds to advanced phishing threats.<\/p>\n","protected":false},"author":24,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"inline_featured_image":false,"footnotes":""},"class_list":["post-70291","post","type-post","status-publish","format-standard","hentry","topic-cyber-resilience","topic-security"],"acf":[],"yoast_head":"<!-- This site is optimized with the Yoast SEO Premium plugin v27.2 (Yoast SEO v27.2) - https:\/\/yoast.com\/product\/yoast-seo-premium-wordpress\/ -->\n<title>A Threat Actor\u2019s Playbook: Common Techniques and How to Bypass MFA - N-able<\/title>\n<meta name=\"description\" content=\"Discover how Adlumin stops Evilginx MFA bypass attacks and protects your business from advanced phishing threats with effective detection and response.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.n-able.com\/es\/blog\/a-threat-actors-playbook-common-techniques-and-how-to-bypass-mfa\" \/>\n<meta property=\"og:locale\" content=\"es_ES\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"A Threat Actor\u2019s Playbook: Common Techniques and How to Bypass MFA - N-able\" \/>\n<meta property=\"og:description\" content=\"Discover how Adlumin stops Evilginx MFA bypass attacks and protects your business from advanced phishing threats with effective detection and response.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.n-able.com\/es\/blog\/a-threat-actors-playbook-common-techniques-and-how-to-bypass-mfa\" \/>\n<meta property=\"og:site_name\" content=\"N-able\" \/>\n<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/NableMSP\" \/>\n<meta property=\"article:published_time\" content=\"2024-08-28T16:40:41+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2025-08-28T09:34:59+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/www.n-able.com\/wp-content\/uploads\/2025\/08\/2508_Adlumin_BlogHeaders_AThreatActorsPlaybook-CommonTechniquesandHowtoBypassMFA.png\" \/>\n\t<meta property=\"og:image:width\" content=\"1600\" \/>\n\t<meta property=\"og:image:height\" content=\"900\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/png\" \/>\n<meta name=\"author\" content=\"N-able\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@Nable\" \/>\n<meta name=\"twitter:site\" content=\"@Nable\" \/>\n<meta name=\"twitter:label1\" content=\"Escrito por\" \/>\n\t<meta name=\"twitter:data1\" content=\"N-able\" \/>\n\t<meta name=\"twitter:label2\" content=\"Tiempo de lectura\" \/>\n\t<meta name=\"twitter:data2\" content=\"8 minutos\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/www.n-able.com\/es\/blog\/a-threat-actors-playbook-common-techniques-and-how-to-bypass-mfa#article\",\"isPartOf\":{\"@id\":\"https:\/\/www.n-able.com\/es\/blog\/a-threat-actors-playbook-common-techniques-and-how-to-bypass-mfa\"},\"author\":{\"name\":\"N-able\",\"@id\":\"https:\/\/www.n-able.com\/es#\/schema\/person\/f46a000e389b6d02bd4b3866e7828a7b\"},\"headline\":\"A Threat Actor\u2019s Playbook: Common Techniques and How to Bypass MFA\",\"datePublished\":\"2024-08-28T17:40:41+01:00\",\"dateModified\":\"2025-08-28T09:34:59+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/www.n-able.com\/es\/blog\/a-threat-actors-playbook-common-techniques-and-how-to-bypass-mfa\"},\"wordCount\":1834,\"publisher\":{\"@id\":\"https:\/\/www.n-able.com\/es#organization\"},\"inLanguage\":\"es\"},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/www.n-able.com\/es\/blog\/a-threat-actors-playbook-common-techniques-and-how-to-bypass-mfa\",\"url\":\"https:\/\/www.n-able.com\/es\/blog\/a-threat-actors-playbook-common-techniques-and-how-to-bypass-mfa\",\"name\":\"A Threat Actor\u2019s Playbook: Common Techniques and How to Bypass MFA - N-able\",\"isPartOf\":{\"@id\":\"https:\/\/www.n-able.com\/es#website\"},\"datePublished\":\"2024-08-28T17:40:41+01:00\",\"dateModified\":\"2025-08-28T09:34:59+00:00\",\"description\":\"Discover how Adlumin stops Evilginx MFA bypass attacks and protects your business from advanced phishing threats with effective detection and response.\",\"inLanguage\":\"es\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/www.n-able.com\/es\/blog\/a-threat-actors-playbook-common-techniques-and-how-to-bypass-mfa\"]}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/www.n-able.com\/es#website\",\"url\":\"https:\/\/www.n-able.com\/es\",\"name\":\"N-able\",\"description\":\"\",\"publisher\":{\"@id\":\"https:\/\/www.n-able.com\/es#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/www.n-able.com\/es?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"es\"},{\"@type\":\"Organization\",\"@id\":\"https:\/\/www.n-able.com\/es#organization\",\"name\":\"N-able\",\"url\":\"https:\/\/www.n-able.com\/es\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"es\",\"@id\":\"https:\/\/www.n-able.com\/es#\/schema\/logo\/image\/\",\"url\":\"https:\/\/www.n-able.com\/wp-content\/uploads\/2021\/02\/logo-n-able-vertical-dark.svg\",\"contentUrl\":\"https:\/\/www.n-able.com\/wp-content\/uploads\/2021\/02\/logo-n-able-vertical-dark.svg\",\"width\":\"1024\",\"height\":\"1024\",\"caption\":\"N-able\"},\"image\":{\"@id\":\"https:\/\/www.n-able.com\/es#\/schema\/logo\/image\/\"},\"sameAs\":[\"https:\/\/www.facebook.com\/NableMSP\",\"https:\/\/x.com\/Nable\",\"https:\/\/www.linkedin.com\/company\/n-able\",\"https:\/\/www.youtube.com\/channel\/UClnp77HHg4aME-S-3fWQhFw\"]},{\"@type\":\"Person\",\"@id\":\"https:\/\/www.n-able.com\/es#\/schema\/person\/f46a000e389b6d02bd4b3866e7828a7b\",\"name\":\"N-able\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"es\",\"@id\":\"https:\/\/secure.gravatar.com\/avatar\/e9c468b7c98137ecdd5508befa660c205a7978133257080a37fb0b1362d53411?s=96&d=mm&r=g\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/e9c468b7c98137ecdd5508befa660c205a7978133257080a37fb0b1362d53411?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/e9c468b7c98137ecdd5508befa660c205a7978133257080a37fb0b1362d53411?s=96&d=mm&r=g\",\"caption\":\"N-able\"}}]}<\/script>\n<!-- \/ Yoast SEO Premium plugin. -->","yoast_head_json":{"title":"A Threat Actor\u2019s Playbook: Common Techniques and How to Bypass MFA - N-able","description":"Discover how Adlumin stops Evilginx MFA bypass attacks and protects your business from advanced phishing threats with effective detection and response.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.n-able.com\/es\/blog\/a-threat-actors-playbook-common-techniques-and-how-to-bypass-mfa","og_locale":"es_ES","og_type":"article","og_title":"A Threat Actor\u2019s Playbook: Common Techniques and How to Bypass MFA - N-able","og_description":"Discover how Adlumin stops Evilginx MFA bypass attacks and protects your business from advanced phishing threats with effective detection and response.","og_url":"https:\/\/www.n-able.com\/es\/blog\/a-threat-actors-playbook-common-techniques-and-how-to-bypass-mfa","og_site_name":"N-able","article_publisher":"https:\/\/www.facebook.com\/NableMSP","article_published_time":"2024-08-28T16:40:41+00:00","article_modified_time":"2025-08-28T09:34:59+00:00","og_image":[{"width":1600,"height":900,"url":"https:\/\/www.n-able.com\/wp-content\/uploads\/2025\/08\/2508_Adlumin_BlogHeaders_AThreatActorsPlaybook-CommonTechniquesandHowtoBypassMFA.png","type":"image\/png"}],"author":"N-able","twitter_card":"summary_large_image","twitter_creator":"@Nable","twitter_site":"@Nable","twitter_misc":{"Escrito por":"N-able","Tiempo de lectura":"8 minutos"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.n-able.com\/es\/blog\/a-threat-actors-playbook-common-techniques-and-how-to-bypass-mfa#article","isPartOf":{"@id":"https:\/\/www.n-able.com\/es\/blog\/a-threat-actors-playbook-common-techniques-and-how-to-bypass-mfa"},"author":{"name":"N-able","@id":"https:\/\/www.n-able.com\/es#\/schema\/person\/f46a000e389b6d02bd4b3866e7828a7b"},"headline":"A Threat Actor\u2019s Playbook: Common Techniques and How to Bypass MFA","datePublished":"2024-08-28T17:40:41+01:00","dateModified":"2025-08-28T09:34:59+00:00","mainEntityOfPage":{"@id":"https:\/\/www.n-able.com\/es\/blog\/a-threat-actors-playbook-common-techniques-and-how-to-bypass-mfa"},"wordCount":1834,"publisher":{"@id":"https:\/\/www.n-able.com\/es#organization"},"inLanguage":"es"},{"@type":"WebPage","@id":"https:\/\/www.n-able.com\/es\/blog\/a-threat-actors-playbook-common-techniques-and-how-to-bypass-mfa","url":"https:\/\/www.n-able.com\/es\/blog\/a-threat-actors-playbook-common-techniques-and-how-to-bypass-mfa","name":"A Threat Actor\u2019s Playbook: Common Techniques and How to Bypass MFA - N-able","isPartOf":{"@id":"https:\/\/www.n-able.com\/es#website"},"datePublished":"2024-08-28T17:40:41+01:00","dateModified":"2025-08-28T09:34:59+00:00","description":"Discover how Adlumin stops Evilginx MFA bypass attacks and protects your business from advanced phishing threats with effective detection and response.","inLanguage":"es","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.n-able.com\/es\/blog\/a-threat-actors-playbook-common-techniques-and-how-to-bypass-mfa"]}]},{"@type":"WebSite","@id":"https:\/\/www.n-able.com\/es#website","url":"https:\/\/www.n-able.com\/es","name":"N-able","description":"","publisher":{"@id":"https:\/\/www.n-able.com\/es#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.n-able.com\/es?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"es"},{"@type":"Organization","@id":"https:\/\/www.n-able.com\/es#organization","name":"N-able","url":"https:\/\/www.n-able.com\/es","logo":{"@type":"ImageObject","inLanguage":"es","@id":"https:\/\/www.n-able.com\/es#\/schema\/logo\/image\/","url":"https:\/\/www.n-able.com\/wp-content\/uploads\/2021\/02\/logo-n-able-vertical-dark.svg","contentUrl":"https:\/\/www.n-able.com\/wp-content\/uploads\/2021\/02\/logo-n-able-vertical-dark.svg","width":"1024","height":"1024","caption":"N-able"},"image":{"@id":"https:\/\/www.n-able.com\/es#\/schema\/logo\/image\/"},"sameAs":["https:\/\/www.facebook.com\/NableMSP","https:\/\/x.com\/Nable","https:\/\/www.linkedin.com\/company\/n-able","https:\/\/www.youtube.com\/channel\/UClnp77HHg4aME-S-3fWQhFw"]},{"@type":"Person","@id":"https:\/\/www.n-able.com\/es#\/schema\/person\/f46a000e389b6d02bd4b3866e7828a7b","name":"N-able","image":{"@type":"ImageObject","inLanguage":"es","@id":"https:\/\/secure.gravatar.com\/avatar\/e9c468b7c98137ecdd5508befa660c205a7978133257080a37fb0b1362d53411?s=96&d=mm&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/e9c468b7c98137ecdd5508befa660c205a7978133257080a37fb0b1362d53411?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/e9c468b7c98137ecdd5508befa660c205a7978133257080a37fb0b1362d53411?s=96&d=mm&r=g","caption":"N-able"}}]}},"_links":{"self":[{"href":"https:\/\/www.n-able.com\/es\/wp-json\/wp\/v2\/posts\/70291","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.n-able.com\/es\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.n-able.com\/es\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.n-able.com\/es\/wp-json\/wp\/v2\/users\/24"}],"replies":[{"embeddable":true,"href":"https:\/\/www.n-able.com\/es\/wp-json\/wp\/v2\/comments?post=70291"}],"version-history":[{"count":0,"href":"https:\/\/www.n-able.com\/es\/wp-json\/wp\/v2\/posts\/70291\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.n-able.com\/es\/wp-json\/wp\/v2\/media?parent=70291"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}