Microsoft's 2026 Digital Defense Report puts MFA-relaying proxy kits at 44.6% of phishing techniques, as phishing rose to 23% of its incident cases. SMS codes and push approvals pass straight through those proxies, so protecting company email now means passkeys or FIDO2 keys, starting with admins and finance staff.
Reality
- Evidence62
- Adoption
- Insufficient
- Hype gap+5
- Incentives40
- Confidence55
systemd-cryptenroll binds LUKS2 volumes to TPM2, FIDO2 and PKCS#11 hardware so unattended Linux nodes can boot with no one typing a passphrase. A safe rollout keeps the old passphrase and an offline recovery key in place until hardware unlock is proven.
Reality
- Evidence58
- Adoption
- Insufficient
- Hype gap0
- Incentives
- Insufficient
- Confidence55
ShinyHunters has shown journalists FBI medical exams that name agents and their addresses, from a set it says covers about 60,000 current and former staff. The FBI has so far confirmed only an incident in FBIJobs-related systems, and the group is threatening to publish within five days.
Reality
- Evidence45
- Adoption
- Insufficient
- Hype gap+20
- Incentives60
- Confidence45
Microsoft told admins on Friday that SMS first-factor sign-in retires from February 2027, and that its own SMS and voice delivery ends on February 1, so tenants that want to keep phone codes must buy telephony elsewhere.
Reality
- Evidence72
- Adoption
- Insufficient
- Hype gap0
- Incentives35
- Confidence74
Varonis Threat Labs' TrustSink needs an already-compromised Global Administrator or Authentication Policy Administrator account. Once the method is registered in the Authentication Methods Policy, it keeps capturing passwords through resets.
Reality
- Evidence58
- Adoption
- Insufficient
- Hype gap+14
- Incentives68
- Confidence57
Calendar, People and Files stop working on December 16, 2026, and Microsoft has already stopped shipping them, leaving a removal job on fleets that took the apps automatically at the end of 2025.
Reality
- Evidence74
- Adoption46
- Hype gap+20
- Incentives58
- Confidence71
The two September 15 disclosures describe a padding oracle and a SAML assertion wrapping bypass in Secret Server's pre-login code path, both reachable without credentials and both already closed in the August build.
Reality
- Evidence55
- Adoption28
- Hype gap+35
- Incentives55
- Confidence47
Delinea scored CVE-2026-15640 at 9.5 on CVSS v4 for on-prem Secret Server 10.5.0 through 12.1.3, and 12.2.7 is the only listed build that also clears the padding oracle and the FIDO2 registration bug.
Publishers:delinea.com
Reality
- Evidence72
- Adoption
- Insufficient
- Hype gap−8
- Incentives74
- Confidence70
Microsoft Security Research describes callers posing as IT staff to get a Microsoft 365 session relayed or minted to their own client. The lasting damage comes from the MFA method they then register.
Reality
- Evidence55
- Adoption40
- Hype gap+15
- Incentives55
- Confidence55
CloudSEK says the kit's JavaScript disrupts FIDO2 on a cloned Microsoft 365 login and steers the victim to TOTP, SMS or push, so the tenant's authentication strength policy decides whether the relay works.
Reality
- Evidence40
- Adoption
- Insufficient
- Hype gap+12
- Incentives50
- Confidence45
BleepingComputer counts at least 39 published passkey attack methods. Most of the ones it names need code on the endpoint or control of a sync account first, and that is where the defensive work actually lands.
Reality
- Evidence42
- Adoption20
- Hype gap+38
- Incentives78
- Confidence45
Island's write-up describes an adversary-in-the-middle proxy that hands passwords, push approvals and SMS codes to real Microsoft servers, then keeps the cookie Microsoft issues. Origin binding is the only listed control that breaks it.
Reality
- Evidence48
- Adoption40
- Hype gap+18
- Incentives66
- Confidence47
HHS now lists 3,756,469 people affected by the March intrusion at CareCloud, up from roughly 345,000. Any vendor decision made on the first number was made on sand.
Reality
- Evidence54
- Adoption64
- Hype gap−12
- Incentives66
- Confidence56
Fifteen transfers worth about $25m went out because the people on the call looked and sounded right. Detection accuracy is near chance, so the surviving control is procedural.
Reality
- Evidence48
- Adoption32
- Hype gap+22
- Incentives66
- Confidence46
Unit 42's three techniques all assume malware is already running on the box. That makes this an endpoint and browser-profile problem, not a reason to stall a passkey deployment.
Reality
- Evidence44
- Adoption24
- Hype gap+12
- Incentives41
- Confidence42