SecurityRogue MFA Provider Can Siphon Passwords
Researchers show how a compromised Entra admin account can turn a trusted external MFA provider into a credential-stealing prompt.
> Search
18 results for “mfa”
Security
Cyber CrimeEvilTokens Takedown Nets Two Arrests in UK
Microsoft-led coalition seizes 50 phishing sites and disables 150 domains tied to an AI-enabled service that compromised 12,000 inboxes.
Cyber CrimeGhostCode Phishing Kit Bypasses MFA
A new phishing kit abuses Microsoft's device-code flow to bypass MFA and establish persistent access to Microsoft 365 environments.
SecurityBasics Before Tools in Cyber Defense
A longtime CISO argues that asset visibility, identity management, and recovery planning matter more than the newest security products.
Cyber CrimePasskey phishing opens M365 data theft playbook
Microsoft ties passkey-themed social engineering to extortion gangs that blend into Microsoft 365 traffic to steal files and email.
Cyber CrimeStolen AI Tokens Skirt Login Checks
Okta's review of a 7 GB infostealer dump found unexpired AI service tokens that can be replayed without a password or MFA.
SecurityPhaaS Campaign Targets IT Providers via M365 Phishing
CloudSEK reports BigBear 2.0 phishing operation stole over 5,100 Microsoft credentials, hitting IT firms hardest.
Cyber CrimeSession Theft Threat Escalates as 4,532 Firms Targeted
Mirage2FA campaign hit 4,532 companies, bypassing MFA and stealing sessions.
SecurityPasskey Defenses Undermined by Weak Surroundings
Recent research shows passkey protections can be bypassed without breaking the underlying cryptography.
Cyber CrimeAitM Phishing Targets Financial Data
A sophisticated phishing campaign uses adversary-in-the-middle tactics to compromise Microsoft 365 accounts for financial espionage.
Cyber CrimeRingCentral Spoof Hijacks M365 Accounts
Phishing service Greatness uses spoofed RingCentral emails to bypass MFA and compromise Microsoft 365 accounts.
SecurityLaw Firms Under Pressure From AiTM Attacks
New data from eSentire indicates that adversary-in-the-middle phishing has bypassed standard authentication protocols at law firms.
SecurityPhishing Kits Adapt to Bypass MFA Flows
Researchers identify Jalisco and OmegaLord as new threats targeting Microsoft 365 through advanced credential and device exploitation.
Cyber CrimeAI Bot Vulnerabilities Expose High-Profile Instagram Accounts
A flaw in Meta’s automated support system allowed attackers to hijack accounts by manipulating conversational AI workflows.
SecurityThe Hidden Dangers Lurking Within Everyday QR Code Scams
Quishing attacks are weaponizing QR codes to bypass traditional security, creating a sophisticated new pathway for account hijacking.
Cyber CrimeThe Massive Scale of the 0ktapus Phishing Campaign Revealed
Researchers identify over 130 firms compromised in a sprawling campaign that successfully bypassed traditional MFA protections.
SecurityThe MFA Illusion: How One Open Server Exposed Next-Gen Phishing
A simple configuration blunder by an attacker unraveled three sophisticated, bypass-capable phishing campaigns targeting Microsoft 365.
Cyber CrimeVishing to Data Heist: Helix Group Elevates SharePoint Extortion Threat
A sophisticated new group named Helix leverages identity-based phishing and MFA abuse to infiltrate corporate SharePoint environments, exfiltrating sensitive data for extortion or sale.