Security news aggregator

Latest coverage for MFA

MFA reduces account takeover by requiring another proof of identity, limiting damage from stolen passwords; protect fallback and recovery paths too.

3 headlines in this view

Refine the feed

Search across headline titles and summaries.

Tag briefing

Background for this topic.

MFA requires a user to prove identity with at least two different factor types: something they know, have, or are. It limits account takeover when a password is exposed, but protection depends on the factors and their implementation; two passwords are not independent factors, and a one-time code delivered by SMS is generally weaker than a phishing-resistant credential.

Attackers may steal or relay one-time codes through phishing, trigger repeated push prompts to induce approval, exploit weak enrollment or account-recovery processes, or hijack an authenticated session after MFA succeeds. Prefer phishing-resistant methods such as FIDO2/WebAuthn security keys or platform credentials for sensitive access, protect enrollment and recovery as strongly as login, restrict weaker fallbacks, and monitor unusual authentication activity. MFA reduces risk but does not replace endpoint, session, or privileged-access controls.

Showing 3 most recent headlines Filtered view
Bank Info Security 1 year, 2 months ago

Nation-State Actors Continue to Exploit Weak Passwords, MFA

Trellix's John Fokker Advises CISOs to Prioritize Patching, MFA, Network VisibilityThreat actors aren't rushing to adopt AI tools to exploit vulnerabilities. "They still prefer a victim with weak passwords, bad MFA, bad patching. It is the easiest way to make money for criminals so they don't have to invest in AI," said John Fokker, head of threat intelligence at Trellix.

More from Bank Info Security 7 May 2025, 6:30 a.m. Adoption Artificial Intelligence CISO Exploit MFA Nation State Passwords Threat Actor Victims Vulnerability
Bank Info Security 1 year, 2 months ago

ANZ Bank to Eliminate Passwords for Digital Banking Services

Hackers Bypass MFA to Steal Australians' Banking CredentialsMelbourne-based ANZ Bank will introduce passwordless authentication for digital banking services amid news that hackers have stolen the banking credentials of tens of thousands of Australians. Cybercriminals used infostealer malware to steal the credentials of more than 30,000 Australians.

More from Bank Info Security 6 May 2025, 8:30 a.m. Authentication Banking Bypass Credentials Finance Malware MFA Passwords Theft
Bank Info Security 1 year, 2 months ago

NCSC Recommends Security Measures Amid UK Retailer Hacks

Urges Companies to Enable MFA, Track Atypical Login AttemptsThe U.K. cyber agency advised British companies to shore up cyber defenses in the wake of a wave of cyberattacks against retailers including against Co-op, Harrods and Mark & Spencer. "We are not yet in a position to say if these attacks are linked," said the National Cybersecurity Center.

More from Bank Info Security 6 May 2025, 6:30 a.m. Cyberattack MFA United Kingdom