Attackers have adapted to MFA defenses, finding ways to steal authentication tokens or trick users into approving requests.

https://www.securitymagazine.com/articles/102667-authentication-shouldnt-end-after-mfa-succeeds