Topic
A security practice requiring two or more independent credentials, such as a password plus a code or device, to verify a user's identity.
Microsoft's mandatory MFA enforcement blocks an Entra break-glass account with no MFA method from admin portals, a dev.to guide says. A vaulted password therefore fails when the lockout it was kept for arrives.
Reality
An Akira affiliate began spraying passwords at a SonicWall SSL VPN on August 4, 2026, and one worked about seven minutes later. The account had no MFA, and the ransomware deployment that followed failed after credentials and file-share data were already stolen.
Reality
Cisco Talos says UAT-11985 used fake event invitations to phish Taiwanese research staff through a kit that relays Google logins and MFA challenges live. For the people those invitations target, the useful control is a second factor the relay cannot pass along.
Reality
ANSSI says stolen staff passwords let an attacker take data on about 600,000 French taxpayers and firms, and the theft went undetected for seven weeks. Its report blames password-only portals, a flat government network and a reset that left the attacker's session open.
Reality
ANSSI says an attacker used dozens of stolen DGFIP staff passwords on password-only portals to take data on over 600,000 French taxpayers and businesses. For other operators, the fixes are login checks on devices they do not manage and a password reset that also ends live sessions.
Reality
Army soldier Cameron Wagenius got 70 months in prison for extorting AT&T with call records taken from Snowflake accounts that lacked MFA. His group got in with exposed credentials alone, and AT&T's $370,000 ransom did not stop the leaks that followed.
Perspective Coverage
7 publishersReality
Google's threat intelligence team ties three suspected Russian clusters to abuse of Google OAuth, app passwords and device linking. MFA completes normally, so consent telemetry is the control.
Reality
Huntress counted 81 million login attempts against Azure CLI in two weeks of June and 78 compromises. Most of the victims had MFA. It just did not apply to the flow the attacker used.
Reality
The FBI published version 6.1 on June 25, 2026, keeping v6.0's NIST-aligned structure while lifting SC-13 and SC-28 to a 256-bit minimum and tripling how often agencies must run vulnerability scans.
Reality
Microsoft told admins on Friday that SMS first-factor sign-in retires from February 2027, and that its own SMS and voice delivery ends on February 1, so tenants that want to keep phone codes must buy telephony elsewhere.
Reality
The OAuth device authorization grant was built for smart TVs and printers. Kits such as EvilTokens use it to get victims to approve an attacker's sign-in on a page that really is Microsoft's, MFA included.
Reality
Huntress showed WWAHost.exe rendering attacker JavaScript with full WinRT access, driving a genuine login.microsoftonline.com prompt. The tokens survive MFA. The gate is Developer Mode.
Reality
Island says the adversary-in-the-middle service runs on at least 755 domains against hundreds of organizations. The session it steals arrives after an authentication the identity provider records as entirely normal.
Reality
Varonis Threat Labs' TrustSink needs an already-compromised Global Administrator or Authentication Policy Administrator account. Once the method is registered in the Authentication Methods Policy, it keeps capturing passwords through resets.
Reality
ESET's Jake Moore says a person can inspect a link exactly as they were taught and still be fooled, because one Cyrillic character renders as the Latin one.
Reality
Varonis Threat Labs registered its own External Authentication Method in a test Entra tenant and served a copy of Microsoft's password prompt during the second factor. Every sign-in completed, and the passwords landed in a file.
Reality
A pool created with the defaults treats a password as the whole authentication factor and scores no risk on the sign-in. In the HackerOne chain a dev.to writeup walks through, either setting turned on would have stopped the takeover.
Reality
CloudSEK got inside the BigBear 2.0 administrative panel and found more captured Microsoft 365 session cookies than plaintext passwords, along with code written to switch FIDO2 off on the phishing pages.
Reality
Microsoft has tracked this since May 2026. First contact lands on an unmanaged personal phone, and the attacker's own authenticator outlives the stolen session, so tenant telemetry only starts after the account is already lost.
Reality
A joint CISA and FBI advisory says the group rehearses a company's password-reset process over several calls before it asks for anything. That puts factor-reset workflows in the identity boundary, not the support queue.
Reality
Product · August 15, 2026 · One report1 publisher