Exploited SonicWall SSL-VPN flaw bypasses SAML-enforced MFA
Attackers with valid alternate credentials can skip SAML MFA; federal agencies must remediate by November 20, 2026.
1
Stories per day · 30 days
4 RSS
Relatedkev2phishing2qilin2sonicwall2adversary-in-the-middle1authentication1canada1cloudfire1globalprotect1google-calendar1ics1identity1inc-ransomware1microsoft-3651mitre-attck1ngate1oauth1palo-alto1
30 stories, newest first · one card per story
Stories tagged #mfa-bypass
Google Calendar phishing campaign hijacks sessions, bypasses MFA
Phishers use live reverse proxies on Google sign-in pages to hijack sessions in real time, evading MFA and reputation checks.
1
Canadian help-desk vishing campaign bypasses MFA in real time
Callers send staff to branded relay pages, then register MFA methods and steal Microsoft 365 data before extortion.
1
OAuth token theft bypasses MFA and outlives password resets, Unit 42 says
Stolen access and refresh tokens can persist for days or months and move across services tied to the same identity.
2
Qilin and INC exploit patched PAN-OS flaw to bypass MFA
Unit 42 says CVE-2026-0257 yields unauthorized VPN sessions, followed by RDP, SMB, and ransomware staging.
2
Ransomware groups exploit GlobalProtect MFA bypass CVE-2026-0257
Unit 42 says attackers forged authentication-override cookies, then pulled domain credentials from a VMware virtual disk offline.
1
MITRE ATT&CK v20 adds AI abuse, MFA bypass, and utility attacks
Enterprise gains nine entries, ICS adds two campaigns plus analytics, and Mobile restores sideloading and NGate.
5
Google AitM Phishing Kit Uses WebSockets to Bypass MFA in Real Time
Cisco Talos says UAT-11985 uses a Google AiTM kit to steal sessions from Taiwan-linked researchers.
Hackers Use AI-Generated Event Lures to Steal Google Accounts and Bypass MFA
UAT-11985 used likely AI-written event invites and an AiTM kit to steal Google sessions from Taiwan researchers.
5
Milk Dragon AiTM Kit Uses Real-Time OTP Relay and WebSocket Keylogging to Bypass MFA
Group-IB says the Milk Dragon kit relays OTPs live to steal shoppers' card payments across 66 countries.
Milk Dragon Phishing Kit Uses Facebook and TikTok Discounts to Steal Cards and Bypass MFA
Milk Dragon uses fake social-media discounts to steal cards and intercept 3-D Secure codes.
5
Lumma, RedLine and Vidar Infostealers Fuel Cloud Credential Theft Campaigns
Lumma, RedLine, and Vidar steal cloud and developer credentials, enabling session hijacking that bypasses MFA.
2
How device code phishing gives scammers access to your account
Device code phishing tricks users into approving a real OAuth sign-in, handing attackers account tokens.
3
OAuth Token Theft Through Microsoft's Front Door | Huntress
Huntress details a WWAHost.exe AppX sideloading technique that presents Microsoft's real OAuth login and harvests tokens that survive MFA.
EvilTokens made phishing-as-a-service look easy. Then it got taken down
Law enforcement takes down EvilTokens PhaaS kit that compromised 12,000 inboxes using AI-powered device-code phishing to bypass MFA.
3
UK Cops arrest 2 EvilTokens suspects, Microsoft seizes 50 phishing kit websites
UK police arrested two EvilTokens admins as Microsoft seized sites used to phish over 12,000 inboxes.
1
AI-Powered RatHat Android Trojan Steals Bank Credentials, PINs and MFA Codes
New AI-driven Android banking trojan RatHat abuses accessibility and ADB to steal bank credentials, PINs, and MFA codes from financial apps.
1
GhostCode Phishing Kit Bypasses Microsoft 365 MFA to Hijack Accounts in 78 Seconds
eSentire identified GhostCode, a phishing kit abusing Microsoft 365 OAuth device-code sign-in to steal tokens and take over accounts in seconds.
6
Infostealer Logs Expose Replayable AI Tokens That Can Bypass MFA
Okta finds infostealer logs contain thousands of replayable AI session tokens and API keys, letting criminals bypass MFA and access services from Google, Anthropic and OpenAI.
2
BigBear phishing crew nets thousands of Microsoft 365 credentials
CloudSEC accessed the BigBear 2.0 phishing panel, finding 5,137 stolen Microsoft 365 records across 461 organizations, including 474 MFA-bypassed sessions.
2
BigBear 2 PhaaS Campaign Steals 5000+ Microsoft Credentials
CloudSEK researchers found the BigBear 2.0 PhaaS kit, built on Evilginx2, has stolen over 5,100 Microsoft 365 credentials across 461 organizations in 40+ countries.
BigBear 2.0 Evilginx2 Phishing Campaign Bypasses Microsoft 365 MFA With Session Cookie Theft
CloudSEK identified BigBear 2.0, an Evilginx2-based AiTM phishing operation stealing Microsoft 365 MFA session cookies, hitting 461 organizations across 40-plus countries.
IT Help Desk Impersonation Lets Hackers Bypass MFA
Arctic Wolf tracks PREY-0058 posing as IT help desk to steal Microsoft 365 sessions via AiTM panels, then extorting executives after SaaS data theft.
2
BigBear Microsoft 365 phishing service bypassed MFA at 258 organizations
The BigBear 2.0 phishing-as-a-service framework bypassed MFA to steal 5,000+ Microsoft 365 credentials across 258 organizations, CloudSEK researchers found.