AiTM MFA bypass: 50074->50140 sign-in error sequence to success

Ibrahim Saud@tektrix

•updated Sep 18, 2026•1•0•1

Detects a sequence of authentication events indicative of Adversary-in-the-Middle (AiTM) phishing, where a user session experiences MFA-related errors (50074, 50140) followed by a successful sign-in (0). This pattern suggests an adversary proxying credentials and MFA requests in real-time.