Topic
Methods attackers use to defeat multi-factor authentication, including push-fatigue, OTP phishing, number matching, device-code and WebAuthn-downgrade tricks.
Island traced fake ChatGPT, Gemini, Claude and Perplexity ad tools to a phishing operation whose Telegram channel took hundreds of victim submissions. Its targets are agency buyers and admins, whose one login can spend several advertisers' balances.
Reality
CloudSEK took administrator access to the panel and counted 5,137 stolen records coming off 42 VPS nodes into five leasing affiliates' Telegram bots, with the phishing pages dark for three weeks while the panel itself stays reachable.
Perspective Coverage
3 publishersReality
The FBI says a subscription kit sold on Telegram harvests Microsoft 365 OAuth tokens through device code lures. The mitigation it recommends is a tenant-wide block, and somebody has to decide the exceptions.
Reality
Microsoft's researchers describe a device code phishing campaign that minted fresh codes the moment a target clicked, defeating the expiry that used to hold these attacks down. The flow it abuses is only needed by hardware that cannot show a login page.
Reality
Fast Company's roundup of four working email scams includes three that never show a link worth hovering over, which leaves both the awareness module and the mobile device policy answering a question users no longer face.
Reality
Google's threat intel group ties UNC6293, UNC7005 and UNC5976 to attacks on OAuth consent, app passwords, device codes and WhatsApp linking. The login succeeds; the token leaves anyway.
Reality
Okta Threat Intelligence says as-a-service phishing kits now let a caller change what the target sees in real time, synced to genuine MFA prompts. Push and OTP were not built to survive that.
Reality