Attackers have adapted to MFA defenses, finding ways to steal authentication tokens or trick users into approving requests.