Two-Factor Authentication Interception

Adversaries may target two-factor authentication mechanisms, such as smart cards, to gain access to credentials that can be used to access systems, services, and network resources. Use of two or multi-factor authentication (2FA or MFA) is recommended and provides a higher level of security than user names and passwords alone, but organizations should be aware of techniques that could be used to intercept and bypass these security mechanisms.

If a smart card is used for two-factor authentication, then a keylogger will need to be used to obtain the password associated with a smart card during normal use. With both an inserted card and access to the smart card password, an adversary can connect to a network resource using the infected system to proxy the authentication with the inserted hardware token. [1]

Adversaries may also employ a keylogger to similarly target other hardware tokens, such as RSA SecurID. Capturing token input (including a user's personal identification code) may provide temporary access (i.e. replay the one-time passcode until the next value rollover) as well as possibly enabling adversaries to reliably predict future authentication values (given access to both the algorithm and any seed values used to generate appended temporary codes). [2]

Other methods of 2FA may be intercepted and used by an adversary to authenticate. It is common for one-time codes to be sent via out-of-band communications (email, SMS). If the device and/or service is not secured, then it may be vulnerable to interception. Although primarily focused on by cyber criminals, these authentication mechanisms have been targeted by advanced actors. [3]

ID: T1111
Sub-techniques:  No sub-techniques
Platforms: Linux, Windows, macOS
System Requirements: Smart card Proxy: Use of smart cards for single or multifactor authentication to access to network resources. Attached smart card reader with card inserted; Out-of-band one-time code: Access to the device, service, or communications to intercept the one-time code; Hardware token: Access to the seed and algorithm of generating one-time codes.
Permissions Required: Administrator, SYSTEM
Contributors: John Lambert, Microsoft Threat Intelligence Center
Version: 1.1
Created: 31 May 2017
Last Modified: 25 March 2020
Provided by LAYER 8

Procedure Examples

ID Name Description
G0114 Chimera

Chimera has registered alternate phone numbers for compromised users to intercept 2FA codes sent via SMS.[4]

G0116 Operation Wocao

Operation Wocao has used a custom collection method to intercept two-factor authentication soft tokens.[5]

S0018 Sykipot

Sykipot is known to contain functionality that enables targeting of smart card technologies to proxy authentication for connections to restricted network resources using detected hardware tokens.[6]


ID Mitigation Description
M1017 User Training

Remove smart cards when not in use.


ID Data Source Data Component
DS0027 Driver Driver Load
DS0009 Process OS API Execution
DS0024 Windows Registry Windows Registry Key Modification

Detecting use of proxied smart card connections by an adversary may be difficult because it requires the token to be inserted into a system; thus it is more likely to be in use by a legitimate user and blend in with other network behavior.

Similar to Input Capture, keylogging activity can take various forms but can may be detected via installation of a driver, setting a hook, or usage of particular API calls associated with polling to intercept keystrokes.