Latest Multi-Factor Authentication news

Cisco Duo warns third-party data breach exposed SMS MFA logs

Cisco Duo's security team warns that hackers stole some customers' VoIP and SMS logs for multi-factor authentication (MFA) messages in a cyberattack on their telephony provider.
- Bill Toulas
- April 15, 2024
- 10:52 AM
- 0
What to do when receiving unprompted MFA OTP codes

Receiving an unprompted one-time passcode (OTP) sent as an email or text should be a cause for concern as it likely means your credentials have been stolen.
- Lawrence Abrams
- December 17, 2023
- 11:06 AM
- 2
Discord adds Security Key support for all users to enhance security

Discord has made security key multi-factor authentication (MFA) available for all accounts on the platform, bringing significant security and anti-phishing benefits to its 500+ million registered users.
- Bill Toulas
- December 14, 2023
- 01:21 PM
- 0
Microsoft Authenticator now blocks suspicious MFA alerts by default

Microsoft has introduced a new protective feature in the Authenticator app to block notifications that appear suspicious based on specific checks performed during the account login stage.
- Bill Toulas
- November 07, 2023
- 10:40 AM
- 1
Microsoft will roll out MFA-enforcing policies for admin portal access

Microsoft will roll out Conditional Access policies requiring multifactor authentication from administrators when signing into Microsoft admin portals such as Microsoft Entra, Microsoft 365, Exchange, and Azure.
- Sergiu Gatlan
- November 06, 2023
- 03:00 PM
- 3
Amazon to make MFA mandatory for 'root' AWS accounts by mid-2024

Amazon will require all privileged AWS (Amazon Web Services) accounts to use multi-factor authentication (MFA) for stronger protection against account hijacks leading to data breaches, starting in mid-2024.
- Bill Toulas
- October 05, 2023
- 01:06 PM
- 2
Retool blames breach on Google Authenticator MFA cloud sync feature

Software company Retool says the accounts of 27 cloud customers were compromised following a targeted and multi-stage social engineering attack.
- Sergiu Gatlan
- September 15, 2023
- 03:15 PM
- 3
W3LL phishing kit hijacks thousands of Microsoft 365 accounts, bypasses MFA

A threat actor known as W3LL developed a phishing kit that can bypass multi-factor authentication along with other tools that compromised more than 8,000 Microsoft 365 corporate accounts.
- Ionut Ilascu
- September 06, 2023
- 06:33 AM
- 2
Microsoft enforces number matching to fight MFA fatigue attacks

Microsoft has started enforcing number matching in Microsoft Authenticator push notifications to fend off multi-factor authentication (MFA) fatigue attacks.
- Sergiu Gatlan
- May 08, 2023
- 12:25 PM
- 0
Outlook app to get built-in Microsoft 365 MFA on Android, iOS

Microsoft will soon fast-track multi-factor authentication (MFA) adoption for its Microsoft 365 cloud productivity platform by adding MFA capabilities to the Outlook email client.
- Sergiu Gatlan
- March 13, 2023
- 01:07 PM
- 1
Bitwarden password vaults targeted in Google ads phishing attack

Bitwarden and other password managers are being targeted in Google ads phishing campaigns to steal users' password vault credentials.
- Lawrence Abrams
- January 26, 2023
- 04:40 PM
- 17
Sponsored Content
MFA Fatigue attacks are putting your organization at risk

A common threat targeting businesses is MFA fatigue attacks—a technique where a cybercriminal attempts to gain access to a corporate network by bombarding a user with MFA prompts. This article includes some measures you can implement to prevent these types of attacks.
- Sponsored by Specops Software
- November 15, 2022
- 10:07 AM
- 1
Sponsored Content
Text message verification flaws in your Windows Active Directory

While text messaging-based MFA goes a long way toward protecting an org against compromised credentials, it also has vulnerabilities of its own. Orgs must look for ways around the flaws associated with test-based MFA by upgrading to multi-factor authentication. Learn more in this article from Specops Software.
- Sponsored by Specops
- October 18, 2022
- 10:06 AM
- 0
Hackers stealing GitHub accounts using fake CircleCI notifications

GitHub is warning of an ongoing phishing campaign that started on September 16 and is targeting its users with emails that impersonate the CircleCI continuous integration and delivery platform.
- Bill Toulas
- September 22, 2022
- 09:40 AM
- 0
MFA Fatigue: Hackers’ new favorite tactic in high-profile breaches

Hackers are more frequently using social engineering attacks to gain access to corporate credentials and breach large networks. One component of these attacks that is becoming more popular with the rise of multi-factor authentication is a technique called MFA Fatigue.
- Lawrence Abrams
- September 20, 2022
- 06:30 AM
- 1
Hackers use AiTM attack to monitor Microsoft 365 accounts for BEC scams

A new business email compromise (BEC) campaign has been discovered combining sophisticated spear-phishing with Adversary-in-The-Middle (AiTM) tactics to hack corporate executives' Microsoft 365 accounts, even those protected by MFA.
- Bill Toulas
- August 24, 2022
- 11:53 AM
- 0
Microsoft accounts targeted with new MFA-bypassing phishing kit

A new large-scale phishing campaign targeting credentials for Microsoft email services use a custom proxy-based phishing kit to bypass multi-factor authentication.
- Bill Toulas
- August 03, 2022
- 02:02 PM
- 0
Microsoft: Phishing bypassed MFA in attacks against 10,000 orgs

Microsoft says a massive series of phishing attacks has targeted more than 10,000 organizations starting with September 2021, using the gained access to victims' mailboxes in follow-on business email compromise (BEC) attacks.
- Sergiu Gatlan
- July 12, 2022
- 01:02 PM
- 0
Clever phishing method bypasses MFA using Microsoft WebView2 apps

A clever, new phishing technique uses Microsoft Edge WebView2 applications to steal victim's authentication cookies, allowing threat actors to bypass multi-factor authentication when logging into stolen accounts.
- Lawrence Abrams
- June 26, 2022
- 10:12 AM
- 3
Hackers use modified MFA tool against Indian govt employees

A new campaign from the hacking group tracked as APT36, aka 'Transparent Tribe' or' Mythic Leopard,' has been discovered using new custom malware and entry vectors in attacks against the Indian government.
- Bill Toulas
- March 29, 2022
- 12:29 PM
- 0