MFA enrolment persistence

Attacker persistence achieved by registering a controlled phone number or authenticator app as an additional authentication method on a compromised identity, allowing re-authentication after the original session ends.