Mfa news

Attackers are using a sophisticated method to steal Microsoft 365 login sessions, allowing them to bypass multi-factor authentication. This token-replay attack has already compromised accounts at dozens of organizations, giving hackers access to sensitive email data.

Security experts are warning that MFA alone is insufficient against sophisticated attacks. Phishing campaigns are increasingly targeting Microsoft 365 access tokens, allowing attackers to bypass MFA entirely. These attacks use specialized kits, highlighting a critical evolution in identity-based threats for organizations.

A new security bulletin highlights several critical issues. Key reports include a new security plugin for the Claude AI model, a potential privilege escalation vulnerability in Microsoft Azure, and a technique for bypassing multi-factor authentication in Kali Linux environments. The bulletin also covers ongoing FIFA-themed scams.

Multi-factor authentication (MFA) is being defeated by a simple tactic. Attackers with stolen credentials spam users with login approval requests, hoping to trick them into granting access out of confusion or fatigue. This method bypasses a core security protection without stealing the second factor.

Google's Threat Intelligence Group reports a rapid rise in Chinese-language Phishing-as-a-Service (PhaaS) platforms. These services are evolving beyond simple credential theft, now using real-time interception and token hijacking to bypass multi-factor authentication, marking a significant shift in the threat landscape.

A new phishing-as-a-service platform called EvilTokens has compromised over 340 Microsoft 365 organizations. The attack tricks users into authorizing a malicious app via a device login flow, effectively bypassing multi-factor authentication and granting attackers access to their accounts without needing passwords or MFA codes.