MFA bypass surged in 2024–2025 with AiTM kits, token theft, SIM swaps, and fatigue. From Tycoon 2FA to Change Healthcare, only phishing-resistant MFA holds.