MFA-Bypass

An unauthenticated remote attacker can exploit CVE-2026-107805 in Nginx UI by sending malicious requests that trigger premature staging of large, unsigned request bodies, leading to disk space and I/O exhaustion.

Prolific infostealer families like Lumma, RedLine, and Vidar are leveraging industrialized malware-as-a-service to exfiltrate session tokens and API keys, enabling bypass of MFA and unauthorized access to cloud, code, and AI environments.

stoatchat versions prior to 0.15.5 are vulnerable to an authentication bypass where attackers can use their own MFA ticket to authenticate against a victim's session.

A session-reuse vulnerability in ZITADEL Login V2 (CVE-2026-85056) allows attackers with valid credentials to bypass MFA by abandoning and restarting the login flow in organizations where MFA is not strictly enforced.

Threat actors are using passkey-themed phishing and adversary-in-the-middle attacks to compromise Microsoft cloud accounts, establish persistent access via registered MFA methods, and exfiltrate data via Microsoft Graph API.

An unspecified attacker conducted a sophisticated SIM swap and identity attack against a personal wireless account by employing social engineering (vishing) to steal an SMS-based One-Time Passcode and account PIN, facilitating session hijacking and unauthorized account modifications like mobile number cancellation, demonstrating critical weaknesses in point-in-time identity verification and the need for continuous risk assessment.

This brief identifies successful logins to the AWS Management Console by standard IAM users without Multi-Factor Authentication (MFA). It focuses on the first observed occurrence within a 7-day history window for each user. An adversary who obtains a user's password can gain access if MFA is not enforced, representing a significant initial access vector. This event signals a critical posture gap that allows adversaries to achieve initial access using compromised credentials, leading to potential privilege escalation, data exfiltration, or resource deployment.

O-UNC-038 is conducting a multi-stage Adversary-in-the-Middle (AiTM) phishing operation that abuses legitimate SaaS platforms and recruiter identities to steal corporate Google Workspace credentials and bypass multi-factor authentication.

An attacker with elevated privileges abuses the Microsoft Entra ID Temporary Access Pass (TAP) feature to bypass multi-factor authentication (MFA), gain unauthorized access to target user accounts, and establish persistence by registering new authentication methods.

Threat actors exploited CVE-2024-12802, a vulnerability in SonicWall Gen6 SSL-VPN appliances, to bypass multi-factor authentication (MFA) after brute-forcing VPN credentials, leading to the deployment of ransomware-related tools.

The Tycoon2FA phishing-as-a-service platform, which bypasses MFA, has resurged to pre-takedown activity levels, indicating continued risk despite law enforcement disruption efforts.

The Tycoon2FA Phishing-as-a-Service (PhaaS) platform, used to bypass MFA and compromise email accounts, has rebounded after a law enforcement takedown, with campaign activity and tactics returning to pre-disruption levels.

The Tycoon2FA PhaaS platform, which facilitates MFA bypass and email account compromise, experienced a temporary decrease in activity following a takedown operation, but campaign volumes have since returned to pre-disruption levels, and TTPs remain consistent.

The Tycoon2FA phishing-as-a-service (PhaaS) platform, disrupted by law enforcement on March 4, 2026, has shown a resurgence in activity, enabling cybercriminals to bypass MFA and compromise email accounts using adversary-in-the-middle (AITM) techniques.

The Tycoon2FA phishing-as-a-service (PhaaS) platform, disrupted by law enforcement on March 4, 2026, has shown a resurgence in activity, enabling cybercriminals to bypass MFA and compromise email accounts using adversary-in-the-middle (AITM) techniques.

The Tycoon2FA phishing-as-a-service platform, which bypasses MFA and compromises email accounts, has rebounded after a takedown, returning to pre-disruption activity levels and continuing to employ established tactics.

The Tycoon2FA Phishing-as-a-Service (PhaaS) platform, disrupted in March 2026, has resurged with cloud compromise active remediations returning to early 2026 levels, continuing to bypass MFA and compromise email accounts through phishing campaigns.

The Tycoon2FA Phishing-as-a-Service (PhaaS) platform, which bypasses multifactor authentication (MFA) to compromise email accounts, experienced a temporary disruption following a law enforcement takedown, but campaign volumes and tactics have returned to pre-disruption levels, indicating the actors are likely to remain active.

The Tycoon2FA phishing-as-a-service (PhaaS) platform, enabling MFA bypass and email account compromise, has rebounded to pre-takedown activity levels, maintaining consistent tactics, techniques, and procedures (TTPs) after a law enforcement disruption.

The Tycoon2FA Phishing-as-a-Service (PhaaS) platform, which bypasses multi-factor authentication (MFA) using adversary-in-the-middle (AITM) techniques, has seen a resurgence in activity to pre-takedown levels despite a law enforcement disruption in March 2026.

The Tycoon2FA PhaaS platform, used for MFA bypass and email compromise, has demonstrated a resurgence in activity following a law enforcement takedown, indicating continued threat actor activity.

The Tycoon2FA Phishing-as-a-Service platform, used to bypass multifactor authentication (MFA), has resurged to pre-takedown levels of activity following a disruption effort in March 2026, maintaining its original tactics, techniques, and procedures (TTPs) for credential harvesting and cloud compromise.

The Tycoon2FA Phishing-as-a-Service platform, used to bypass multifactor authentication (MFA), has resurged to pre-takedown levels of activity following a disruption effort in March 2026, maintaining its original tactics, techniques, and procedures (TTPs) for credential harvesting and cloud compromise.

Parse Server versions before 8.6.61 and versions 9.0.0 to 9.6.0-alpha.55 expose sensitive MFA credentials via the `/users/me` endpoint, allowing authenticated users to extract TOTP secrets and recovery codes.

An AWS IAM user is creating keys and applying encryption policies without multi-factor authentication (MFA), potentially indicating an attempt to establish persistent access and bypass security controls.

An adversary may attempt to bypass MFA by bombarding a user with repeated authentication requests, potentially leading to unauthorized access and system compromise.

Detects anomalous Azure AD authentication activity characterized by a single user exceeding 8 authentication attempts, utilizing 3+ unique application IDs and 5+ unique user agents within a 5-minute window, potentially indicating MFA probing or account compromise.

An adversary attempts to compromise Okta accounts by brute-forcing device tokens to bypass multi-factor authentication (MFA) and gain unauthorized access.