Latest Multi-Factor Authentication news

Microsoft accounts targeted with new MFA-bypassing phishing kit

A new large-scale phishing campaign targeting credentials for Microsoft email services use a custom proxy-based phishing kit to bypass multi-factor authentication.
- Bill Toulas
- August 03, 2022
- 02:02 PM
- 0
Microsoft: Phishing bypassed MFA in attacks against 10,000 orgs

Microsoft says a massive series of phishing attacks has targeted more than 10,000 organizations starting with September 2021, using the gained access to victims' mailboxes in follow-on business email compromise (BEC) attacks.
- Sergiu Gatlan
- July 12, 2022
- 01:02 PM
- 0
Clever phishing method bypasses MFA using Microsoft WebView2 apps

A clever, new phishing technique uses Microsoft Edge WebView2 applications to steal victim's authentication cookies, allowing threat actors to bypass multi-factor authentication when logging into stolen accounts.
- Lawrence Abrams
- June 26, 2022
- 10:12 AM
- 3
Hackers use modified MFA tool against Indian govt employees

A new campaign from the hacking group tracked as APT36, aka 'Transparent Tribe' or' Mythic Leopard,' has been discovered using new custom malware and entry vectors in attacks against the Indian government.
- Bill Toulas
- March 29, 2022
- 12:29 PM
- 0
FBI warns of MFA flaw used by state hackers for lateral movement

The FBI says Russian state-backed hackers gained access to a non-governmental organization (NGO) cloud after enrolling their own device in the organization's Duo MFA following the exploitation of misconfigured default multifactor authentication (MFA) protocols.
- Sergiu Gatlan
- March 15, 2022
- 05:20 PM
- 0
Android malware Escobar steals your Google Authenticator MFA codes

The Aberebot banking trojan appears to have returned, as its author is actively promoting a new version of the tool on dark web markets and forums.
- Bill Toulas
- March 12, 2022
- 10:12 AM
- 0
Devious phishing method bypasses MFA using remote access software

A devious new phishing technique allows attackers to bypass MFA by secretly having victims log in to their accounts directly on attacker-controlled servers using VNC.
- Lawrence Abrams
- February 22, 2022
- 04:57 PM
- 2
Google sees 50% security boost for 150M users after 2FA enroll

After accelerating its efforts to auto-enroll as many accounts as possible in two-factor authentication (2FA), Google announced that an additional 150 million users now have 2FA enabled.
- Sergiu Gatlan
- February 08, 2022
- 06:00 AM
- 0
Microsoft blocked billions of brute-force and phishing attacks last year

Office 365 and Azure Active Directory (Azure AD) customers were the targets of billions of phishing emails and brute force attacks successfully blocked last year by Microsoft.
- Sergiu Gatlan
- February 03, 2022
- 11:35 AM
- 1
MFA adoption pushes phishing actors to reverse-proxy solutions

The rising adoption of multi-factor authentication (MFA) for online accounts pushes phishing actors to use more sophisticated solutions to continue their malicious operations, most notably reverse-proxy tools.
- Bill Toulas
- February 03, 2022
- 09:42 AM
- 2
US universities targeted by Office 365 phishing attacks

US universities are being targeted in multiple phishing attacks designed to impersonate college login portals to steal valuable Office 365 credentials.
- Bill Toulas
- December 07, 2021
- 03:23 PM
- 0
Google to auto-enroll 150 million user accounts into 2FA

Google announced today that they plan on auto-enrolling 150 million accounts into two-factor authentication by the end of 2021.
- Lawrence Abrams
- October 05, 2021
- 03:53 PM
- 3
Hackers rob thousands of Coinbase customers using MFA flaw

Crypto exchange Coinbase disclosed that a threat actor stole cryptocurrency from 6,000 customers after using a vulnerability to bypass the company's SMS multi-factor authentication security feature.
- Lawrence Abrams
- October 01, 2021
- 10:32 AM
- 2
Microsoft 365 MFA outage locks users out of their accounts

Microsoft is investigating an ongoing Multi-Factor Authentication (MFA) issue preventing some customers from logging into their Microsoft 365 accounts.
- Sergiu Gatlan
- September 28, 2021
- 11:19 AM
- 0
CISA: Don’t use single-factor auth on Internet-exposed systems

Single-factor authentication (SFA) has been added today by the US Cybersecurity and Infrastructure Security Agency (CISA) to a very short list of cybersecurity bad practices it advises against.
- Sergiu Gatlan
- August 30, 2021
- 01:10 PM
- 0
Google wants to enable multi-factor authentication by default

Google strives to push all its users to start using two-factor authentication (2FA), which can block attackers from taking control of their accounts using compromised credentials or guessing their passwords.
- Sergiu Gatlan
- May 06, 2021
- 05:05 PM
- 0
US think tank breached three times in a row by SolarWinds hackers

An advanced hacking group believed to be working for the Russian government has compromised the internal network of a think tank in the U.S. three times.
- Ionut Ilascu
- December 17, 2020
- 03:17 PM
- 0