Security news aggregator

Latest coverage for MFA

MFA reduces account takeover by requiring another proof of identity, limiting damage from stolen passwords; protect fallback and recovery paths too.

10 headlines in this view

MFA requires a user to prove identity with at least two different factor types: something they know, have, or are. It limits account takeover when a password is exposed, but protection depends on the factors and their implementation; two passwords are not independent factors, and a one-time code delivered by SMS is generally weaker than a phishing-resistant credential.

Attackers may steal or relay one-time codes through phishing, trigger repeated push prompts to induce approval, exploit weak enrollment or account-recovery processes, or hijack an authenticated session after MFA succeeds. Prefer phishing-resistant methods such as FIDO2/WebAuthn security keys or platform credentials for sensitive access, protect enrollment and recovery as strongly as login, restrict weaker fallbacks, and monitor unusual authentication activity. MFA reduces risk but does not replace endpoint, session, or privileged-access controls.

Showing 10 most recent headlines Filtered view

The Register 4 years ago

This big phish can swim around MFA, says Microsoft Security

Slippery AiTM attacks targeted more than 10,000 orgs over the past nine months A widespread phishing campaign that has hit more than 10,000 organizations since September 2021 uses adversary-in-the-middle (AiTM) proxy sites to get around multifactor authentication (MFA) features and steal credentials that are then used to compromise business email accounts.…

More from The Register 14 Jul 2022, 7:04 a.m. Authentication Compromise Credentials Email MFA Microsoft Phishing Proxy Theft

Naked Security 4 years ago

Facebook 2FA scammers return – this time in just 21 minutes

Last time they arrived 28 minutes after lighting up their fake domain... this time it was just 21 minutes

More from Naked Security 14 Jul 2022, 4:46 a.m. Facebook MFA Scam

Dark Reading 4 years ago

Microsoft: 10,000 Orgs Targeted in Phishing Attack That Bypasses Multifactor Authentication

The massive phishing campaign does not exploit a vulnerability in MFA. Instead, it spoofs an Office 365 authentication page to steal credentials.

More from Dark Reading 14 Jul 2022, 2:54 a.m. Authentication Credentials Exploit MFA Microsoft Office 365 Phishing Theft Vulnerability

Threat Post 4 years ago

Large-Scale Phishing Campaign Bypasses MFA

Attackers used adversary-in-the-middle attacks to steal passwords, hijack sign-in sessions and skip authentication and then use victim mailboxes to launch BEC attacks against other targets.

More from Threat Post 13 Jul 2022, 11:45 p.m. Authentication MFA Passwords Phishing Theft Victims

The Hacker News 4 years ago

Microsoft Warns of Large-Scale AiTM Phishing Attacks Against Over 10,000 Organizations

Microsoft on Tuesday disclosed that a large-scale phishing campaign targeted over 10,000 organizations since September 2021 by hijacking Office 365's authentication process even on accounts secured with multi-factor authentication (MFA)

More from The Hacker News 13 Jul 2022, 10:26 p.m. Authentication Compromise Credentials Disclosure Email MFA Microsoft Office 365 Phishing Theft Warning

Info Security Magazine 4 years ago

Microsoft Details How Phishing Campaign Bypassed MFA

A large-scale phishing campaign stole passwords, hijacked a user’s sign-in session and skipped the authentication process even if MFA was enabled

More from Info Security Magazine 13 Jul 2022, 10:16 p.m. Authentication MFA Microsoft Passwords Phishing

Dark Reading 4 years ago

PyPI Mandates 2FA, Plans Google Titan Key Giveaway

Python's most popular package manager is intent on securing the supply chain by requiring developers to enable two-factor authentication.

More from Dark Reading 13 Jul 2022, 10:42 a.m. Authentication Google MFA Package Manager Python Supply Chain

Bleeping Computer 4 years ago

Microsoft: Phishing bypassed MFA in attacks against 10,000 orgs

Microsoft says a massive series of phishing attacks has targeted more than 10,000 organizations starting with September 2021, using the gained access to victims' mailboxes in follow-on business email compromise (BEC) attacks. [...]

More from Bleeping Computer 13 Jul 2022, 5:02 a.m. Compromise Email MFA Microsoft Phishing Victims

Info Security Magazine 4 years ago

PyPI Repository Enforces 2FA for Critical Python Projects

PyPI also offered free hardware security keys from the Google Open Source Security Team

More from Info Security Magazine 12 Jul 2022, 3:05 a.m. Google MFA Open Source Python

The Hacker News 4 years ago

PyPI Repository Makes 2FA Security Mandatory for Critical Python Projects

The maintainers of the official third-party software repository for Python have begun imposing a new two-factor authentication (2FA) condition for projects deemed "critical." "We've begun rolling out a 2FA requirement: soon, maintainers of critical projects must have 2FA enabled to publish, update, or modify them," Python Package Index (PyPI) said in a tweet last week

More from The Hacker News 11 Jul 2022, 5:23 p.m. Authentication MFA Python