Tag
4 articles covering MFA across campaign analysis, detection engineering, and defender tradecraft.
Field Analysis
Revised October 2026. Our April assessment held that passkey fallback and recovery workflows would become attacker targets. Six months of research confirmed it and added something we did not anticipate: attacks against synced passkey key material itself.
Field Analysis
A June 2026 wave of AWS console phishing sites relayed sign-in and MFA to the real AWS in real time, capturing session material from a curated list of engineers. AiTM has moved past Microsoft identity, and the detection has to move with it.
Read more:Datadog Security LabsNVISO Labs
Field Analysis
Phishing-resistant authentication reduces token theft risk, but account recovery, device replacement, and exception handling can reintroduce phishable paths.
Read more:CISAMicrosoft Security Blog
Field Analysis
New phishing kits are pivoting from simple password theft to real-time token capture and replay workflows targeting modern MFA deployments.
Read more:The Hacker NewsThe Hacker News