Latest Multi-Factor Authentication news

Hackers abused API to verify millions of Authy MFA phone numbers

Twilio has confirmed that an unsecured API endpoint allowed threat actors to verify the phone numbers of millions of Authy multi-factor authentication users, potentially making them vulnerable to SMS phishing and SIM swapping attacks.
- Lawrence Abrams
- July 03, 2024
- 12:43 PM
- 2
Scathing report on Medibank cyberattack highlights unenforced MFA

A scathing report by Australia's Information Commissioner details how misconfigurations and missed alerts allowed a hacker to breach Medibank and steal data from over 9 million people.
- Lawrence Abrams
- June 18, 2024
- 01:25 PM
- 1
Sponsored Content
How to meet evolving MFA demands in the current threat landscape

Multi-factor authentication (MFA) is a crucial weapon in the fight against cybercrime, significantly enhancing online security. Learn more from Specops Software on how to stay on top of the rapidly evolving requirements?
- Sponsored by Specops Software
- June 13, 2024
- 10:01 AM
- 0
Microsoft to start enforcing Azure multi-factor authentication in July

Starting in July, Microsoft will begin gradually enforcing multi-factor authentication (MFA) for all users signing into Azure to administer resources.
- Sergiu Gatlan
- May 17, 2024
- 02:53 PM
- 1
Cisco Duo warns third-party data breach exposed SMS MFA logs

Cisco Duo's security team warns that hackers stole some customers' VoIP and SMS logs for multi-factor authentication (MFA) messages in a cyberattack on their telephony provider.
- Bill Toulas
- April 15, 2024
- 10:52 AM
- 0
What to do when receiving unprompted MFA OTP codes

Receiving an unprompted one-time passcode (OTP) sent as an email or text should be a cause for concern as it likely means your credentials have been stolen.
- Lawrence Abrams
- December 17, 2023
- 11:06 AM
- 2
Discord adds Security Key support for all users to enhance security

Discord has made security key multi-factor authentication (MFA) available for all accounts on the platform, bringing significant security and anti-phishing benefits to its 500+ million registered users.
- Bill Toulas
- December 14, 2023
- 01:21 PM
- 0
Microsoft Authenticator now blocks suspicious MFA alerts by default

Microsoft has introduced a new protective feature in the Authenticator app to block notifications that appear suspicious based on specific checks performed during the account login stage.
- Bill Toulas
- November 07, 2023
- 10:40 AM
- 1
Microsoft will roll out MFA-enforcing policies for admin portal access

Microsoft will roll out Conditional Access policies requiring multifactor authentication from administrators when signing into Microsoft admin portals such as Microsoft Entra, Microsoft 365, Exchange, and Azure.
- Sergiu Gatlan
- November 06, 2023
- 03:00 PM
- 3
Amazon to make MFA mandatory for 'root' AWS accounts by mid-2024

Amazon will require all privileged AWS (Amazon Web Services) accounts to use multi-factor authentication (MFA) for stronger protection against account hijacks leading to data breaches, starting in mid-2024.
- Bill Toulas
- October 05, 2023
- 01:06 PM
- 2
Retool blames breach on Google Authenticator MFA cloud sync feature

Software company Retool says the accounts of 27 cloud customers were compromised following a targeted and multi-stage social engineering attack.
- Sergiu Gatlan
- September 15, 2023
- 03:15 PM
- 3
W3LL phishing kit hijacks thousands of Microsoft 365 accounts, bypasses MFA

A threat actor known as W3LL developed a phishing kit that can bypass multi-factor authentication along with other tools that compromised more than 8,000 Microsoft 365 corporate accounts.
- Ionut Ilascu
- September 06, 2023
- 06:33 AM
- 2
Microsoft enforces number matching to fight MFA fatigue attacks

Microsoft has started enforcing number matching in Microsoft Authenticator push notifications to fend off multi-factor authentication (MFA) fatigue attacks.
- Sergiu Gatlan
- May 08, 2023
- 12:25 PM
- 0
Outlook app to get built-in Microsoft 365 MFA on Android, iOS

Microsoft will soon fast-track multi-factor authentication (MFA) adoption for its Microsoft 365 cloud productivity platform by adding MFA capabilities to the Outlook email client.
- Sergiu Gatlan
- March 13, 2023
- 01:07 PM
- 1
Bitwarden password vaults targeted in Google ads phishing attack

Bitwarden and other password managers are being targeted in Google ads phishing campaigns to steal users' password vault credentials.
- Lawrence Abrams
- January 26, 2023
- 04:40 PM
- 19
Sponsored Content
MFA Fatigue attacks are putting your organization at risk

A common threat targeting businesses is MFA fatigue attacks—a technique where a cybercriminal attempts to gain access to a corporate network by bombarding a user with MFA prompts. This article includes some measures you can implement to prevent these types of attacks.
- Sponsored by Specops Software
- November 15, 2022
- 10:07 AM
- 1
Sponsored Content
Text message verification flaws in your Windows Active Directory

While text messaging-based MFA goes a long way toward protecting an org against compromised credentials, it also has vulnerabilities of its own. Orgs must look for ways around the flaws associated with test-based MFA by upgrading to multi-factor authentication. Learn more in this article from Specops Software.
- Sponsored by Specops
- October 18, 2022
- 10:06 AM
- 0
Hackers stealing GitHub accounts using fake CircleCI notifications

GitHub is warning of an ongoing phishing campaign that started on September 16 and is targeting its users with emails that impersonate the CircleCI continuous integration and delivery platform.
- Bill Toulas
- September 22, 2022
- 09:40 AM
- 0
MFA Fatigue: Hackers’ new favorite tactic in high-profile breaches

Hackers are more frequently using social engineering attacks to gain access to corporate credentials and breach large networks. One component of these attacks that is becoming more popular with the rise of multi-factor authentication is a technique called MFA Fatigue.
- Lawrence Abrams
- September 20, 2022
- 06:30 AM
- 1
Hackers use AiTM attack to monitor Microsoft 365 accounts for BEC scams

A new business email compromise (BEC) campaign has been discovered combining sophisticated spear-phishing with Adversary-in-The-Middle (AiTM) tactics to hack corporate executives' Microsoft 365 accounts, even those protected by MFA.
- Bill Toulas
- August 24, 2022
- 11:53 AM
- 0