NIST publishes plain-language cyber guide for solo business owners
Cybersecurity White Paper 50 translates the Cybersecurity Framework for non-employer firms, which NIST says are 81.9% of U.S. businesses.
Stories per day · 30 days
6 RSS
Relatedpasskeys6phishing5sonicwall5entra-id4saml4aitm3credential-theft3identity3microsoft-3653social-engineering3ssl-vpn3authentication2bec2business-email-compromise2cisa2fido2google2kev2
66 stories, newest first · one card per story
Stories tagged #mfa
SonicWall SSL-VPN MFA bypass flaw exploited in attacks
CISA added CVE-2026-19868 to KEV after exploitation; affects SonicOS SSL-VPN with SAML MFA
1
SonicWall SSL-VPN flaw CVE-2026-19868 can bypass SAML MFA
SonicWall calls exploitation only potential; Gen7 through 7.3.3-7015 and Gen8 through 8.2.2-8015 need firmware, with no workaround.
Service desk account recovery can bypass stronger login controls
A Specops explainer cites Scattered Spider, deepfakes and voice phishing as reasons to drop knowledge-based checks.
1
Passkeys stop credential theft but do not remove identity risk
A successful passkey login does not prove the account, device, or later session should still be trusted.
Microsoft will retire Entra ID SMS and voice sign-in in February 2027
Worldwide and GCC tenants must move telephone-only users to passkeys or another provider before February 1, 2027.
Microsoft urges Entra ID admins to replace SMS and voice with passkeys
Retirement of Microsoft-provided phone authentication starts February 1, 2027, in Worldwide and Government Community Cloud tenants.
Microsoft tells Entra ID admins to leave SMS and voice before 2027
Microsoft-provided SMS and voice MFA end February 1, 2027 for workforce tenants, not Azure AD B2C or Entra External ID.
Generative AI is making fake login pages easier to scale
The 2026 Verizon DBIR linked phishing to 44% of the AI-assisted initial-access techniques it examined.
1
Token-spraying campaign hits Microsoft 365 accounts for email fraud
Huntress counted at least 200,000 login attempts and 497 successful sign-ins from July to September 2026.
1
M365 token spray and replay campaign hits 79 organizations
Huntress saw 497 successful sign-ins and more than 200,000 failed attempts from July 14 to September 22, 2026.
3
Scattered Spider uses help-desk calls to bypass MFA
Flare says a help-desk call alone does not prove the group, and CISA urges phishing-resistant MFA.
1
Fake Amazon Music deal phishes YouTube creators for Google logins
A portal at amazonyt[.]com shows public channel stats, then a overlaid page collects Google passwords and MFA codes.
Vendor guide lists five CJIS v6.1 priorities for criminal-justice agencies
Specops pitches MFA and password tools while recapping IA-2, IA-5 and account-review rules agencies already face.
Survey finds frontline workers bypass MFA and share logins
Of 700 decision-makers, 95% saw login workarounds and 28% confirmed account-recovery abuse attempts.
UAT-11985 Uses Fake Event Invites to Target Taiwan Research Affiliates With Google AitM Phishing
Cisco Talos says UAT-11985 uses fake event invites and Google AitM phishing against Taiwan research affiliates.
9
Your AI Agent Doesn’t Have MFA
Report says AI agents lack MFA and have already misused credentials and spread malware.
7
Hackers disguise phishing as promising business opportunities
Fortra tracked a twelvefold rise in RFQ phishing that steals business credentials, MFA data, and sessions.
MITRE ATT&CK v20 Added 9 New Attack Techniques Covering AI Exploits, MFA Bypass, and CAPTCHA Evasion
MITRE ATT&CK v20 adds nine techniques for AI attacks, MFA bypass, and CAPTCHA evasion.
Passkeys Raise the Bar. Here’s Where Attackers Can Still Get In.
Huntress says the EvilTokens device-code phishing kit hit 344 organizations without breaking passkey cryptography.
How to Run a Deepfake Readiness Drill Before a Cloned Voice Calls Your Team
Teams are urged to drill out-of-band checks against cloned-voice payment, help-desk, and admin-access fraud.
3
VMware is pushing so many patches, it thinks users need new tools to manage the flood
Broadcom will sell HyperArmor to virtually patch VCF, lock configurations, and add MFA.
UAT-11985: AI-assisted event lures delivering real-time Google AitM phishing
Cisco Talos says UAT-11985 phished Taiwan researchers with AI-assisted event lures and real-time Google AitM.
Cheapskates wouldn't pay for security help, got hit by ransomware, and went bust months later
A construction firm that declined security help was hit by ransomware, lost its only backup, and went bust; second anecdote details AiTM Microsoft 365 phishing.
2