What the warning actually said
The FBI's Kali365 advisory described a tool that lets an attacker ride a victim's session past MFA. The headline everyone grabbed was "bypasses MFA." The detail fewer people read was how it does it: by stealing an already-authenticated session, not by defeating the second factor at the door.
That distinction matters because it changes what would actually stop the attack. A stronger second factor does nothing if the attacker is already inside the session. What stops it is binding the session to a real, present person.
Why stronger auth is the wrong reflex
When the threat is session theft, the lever is not "harder authentication." It is continuous proof that the person who started the session is still the one acting. That is a different problem, and it needs a different tool.
What to take away
Read advisories past the headline. The bypass is rarely where the headline says it is, and the fix is rarely what the reflex suggests.