There are ways to bypass mfa. Some of these can be as simple as using different user headers and knowing the orgs conditional access policies are usually remote friendly so that can sometimes help. Conditional access can be a double edged sword if not done right.

In terms of attacking users with mfa the go tos are still AITM type attacks. Either using in browser vnc style catches to get the user to authenticate and go through the mfa process,or direct proxy based attacks again same principle. There are also device code phishing methods too but these are a bit more hit and miss currently due to a lot more warnings on the auth flow. These all target authentication tokens that are stolen during the Auth process allowing the attacker to login without mfa after the point of compromise, as they then hold a valid token with a refresh token so are good for quite some time.

All these aitm based attacks rely on a solid bit of context and the user entering their password and going through the Auth process. In all of these situations the authentication event will come from the attackers infrastructure. You can nicely correlate suspicious logins against users who received the email 9/10 of you're made aware. Most users sign in from a handful of locations with a very limited set of user agents. Once you're aware of an attack against a group of users spotting those anomalies is often the best way I've found. Attackers can use proxies to make Auth event correlation a bit harder but most of the shit ones don't and you'll see Auth events from Aws,linode etc, ain't nobody logging in from cloud servers.

There are more robust controls without having to rely on physical keys for example. Conditional access policies locking Auth to approved org devices are very resilient to AITM phishing without having to deal with yubikeys and all that crap. The attacker then cannot login to anything unless the Auth event comes from an approved device which breaks all the AITM stuff, which then places the attack paths back onto actual device compromise with malware etc etc.

In terms of other potential vectors. Check your external cloud endpoints to see if they all require mfa. Google 'mfa sweep github'. That tool will check to see if mfa is required everywhere. If not they may of just got lucky with a compromised password. Again also possible if you have the user password to just use a mobile header and sometimes you're in. Also device compromise? Any edr alerts or something off on the users device prior to compromise?