Latest cybersecurity reporting from selected sources.

Misconfigured server exposed three phishing operators running Evilginx forks to bypass MFA

Tycoon2FA phishing platform resumes activity post-takedown, leveraging AITM techniques to bypass MFA

Threat actors posing as IT support teams use phishing kits to generate fake login sites in real-time to trick victims into handing over credentials

SecurityScorecard revealed that the large-scale password spraying campaign can bypass MFA and security access policies by utilizing Non-interactive sign-ins

Threat researchers analyzed the updated Tycoon 2FA phishing kit, which bypasses MFA

Microsoft MFA flaw exposed that allowed attackers to bypass security within an hour, putting 400m Office 365 accounts at risk

Three British men are facing jail after pleading guilty to running an MFA bypass site dubbed “OTP Agency”

Darktrace reveals a novel phishing campaign where attackers leveraged legitimate Dropbox infrastructure to steal credentials before bypassing MFA

Threat actors evolve to multi-factor authentication

CloudSEK said that in some applications such as WhatsApp, attackers could also bypass 2FA

Proofpoint reveals surge in direct financial losses from attacks

Proofpoint warns of use of transparent reverse proxies