Topic
Migration away from push, SMS and TOTP factors toward origin-bound authenticators, and the way enrolment migrations themselves become a social engineering pretext.
Microsoft Security Research describes callers posing as IT staff to get a Microsoft 365 session relayed or minted to their own client. The lasting damage comes from the MFA method they then register.
Reality
Prophet Security investigated every alert in its customers' environments from May through July and found account takeovers turned on how the intruder arrived, with stolen passwords usually stopped and stolen sessions running for weeks.
Reality
CloudSEK says the kit's JavaScript disrupts FIDO2 on a cloned Microsoft 365 login and steers the victim to TOTP, SMS or push, so the tenant's authentication strength policy decides whether the relay works.
Reality
Essential entities face up to EUR 10 million or 2 percent of global turnover, and management bodies can be barred from executive roles, which makes access control the one Article 21 requirement a team can finish and evidence inside a month.
Reality
Fifteen transfers worth about $25m went out because the people on the call looked and sounded right. Detection accuracy is near chance, so the surviving control is procedural.
Reality
Google says the BlackFile crew has targeted dozens of organisations by phoning staff and posing as internal IT. No vendor bug is involved, which puts the remedy on IT leadership.
Reality