mfa bypass5 articles
Refused security help, got ransomwared, went bust. Classic.
A small construction company that rejected cybersecurity consulting advice was hit by ransomware weeks later, losing all its data including encrypted backups, and went out of business within months. In a separate incident, attackers used a compromised executive email account to launch a sophisticated phishing campaign against a partner company, employing a man-in-the-middle attack to bypass two-factor authentication. The second attack was thwarted because the target had software in place to detect anomalous logins and revoke access tokens before serious damage could be done.
Fake Passkeys and CEO Impersonation: Microsoft Exposes Two Nasty Cloud Attack Campaigns
Microsoft has revealed two threat actor campaigns targeting organizations: one involving over a million scam emails impersonating CEOs to trick finance departments into making fraudulent ACH transfers, and another using passkey-themed social engineering to compromise Microsoft cloud accounts. The second campaign involves attackers posing as IT helpdesk staff to lure employees into fake Microsoft sign-in pages, enabling credential theft or unauthorized account access, after which they establish persistent MFA footholds and exfiltrate data from SharePoint, OneDrive, and Exchange. Microsoft has linked the activity to multiple threat actors, including Storm-3032 (identified as UNC6671), with overlaps noted in shared phishing infrastructure associated with the cybercrime collective also tracked as Cordial Spider.
Kratos Phishing Kit Dismantled: 200 Servers Down, But 1,800 Customers Still Have the Code
German and US authorities, alongside Indonesian police, have dismantled Kratos, a major phishing-as-a-service platform that enabled around 1,800 criminal customers to run approximately 15,000 phishing campaigns per month, taking more than 200 servers offline and arresting its alleged developer. The kit was particularly dangerous due to its adversary-in-the-middle capability, which stole live Microsoft 365 session cookies alongside credentials, allowing attackers to bypass multi-factor authentication entirely. However, the takedown leaves the kit's existing customer base and their copies of the code untouched, raising concerns that similar operations could resurface under a new name.
EvilTokens Phishing Kit Is Far Nastier Than Anyone Realised
EvilTokens, a device-code phishing kit capable of bypassing multi-factor authentication on Microsoft 365, has been found to be more sophisticated than previously understood, with Cisco Talos uncovering a linked phishing-as-a-service operator panel called "ARToken." Talos revealed how the phishing lures reach victims' inboxes, describing a targeted approach that exploits real vendor relationships and abuses legitimate SharePoint domains to evade detection. Beyond simple credential theft, ARToken includes a comprehensive post-exploitation toolkit with full business email compromise capabilities, making it a complete BEC operations platform rather than just a phishing kit.
Kali365 Phishing Kit Graduates From Microsoft Nuisance to Multi-Platform Menace
Kali365, a phishing-as-a-service platform previously flagged by the FBI for bypassing Microsoft 365 MFA, has significantly expanded its targets to include AWS, Okta, Xerox DocuShare, and major Russian platforms such as MAX Messenger, Mail.ru, and Yandex. The platform exploits **device code phishing**, abusing OAuth 2.0 authentication workflows to capture access tokens after tricking victims into completing login steps on behalf of attackers — rendering MFA ineffective as a defence. Security researchers at Arctic Wolf identified 126 active malicious hosts in May 2026, highlighting Kali365's growing scale and the broader surge in device code phishing kits, of which at least 14 are now available to threat actors.