Adding two-factor authentication (2FA) to your account security is always a good idea, but it's not impenetrable. Hackers are finding new ways to skirt these defenses and access people's accounts. For example, a new phishing attack can access Microsoft 365 accounts, even if the target has 2FA enabled.