Authentication Intelligence

Every breach that
legacy MFA couldn't stop,
but MFA 2.0 would have.

Expert analysis of real-world authentication failures — and what phish-proof MFA 2.0 would have changed. Published by Al Lakhani, Founder of IDEE GmbH.

Latest Reports

Phishing-proof MFA stops ASOS credential handoff
ASOS lost workforce logins to a fake trusted contact, then third-party platform access. Phishing-proof MFA stops speakable secrets; post-login sessions still need revoke hygiene.
→
Phishing-proof MFA stops TA419 M365 AiTM login
TA419's AiTM kit proxies real Entra logins to capture M365 session cookies. Phishing-proof MFA stops that AiTM capture; stolen cookies still need revoke, not another login factor.
→
Block device-code flow to blunt EvilTokens theft
EvilTokens issued M365 OAuth tokens after real MFA on microsoft.com. Login MFA cannot undo that grant. Block device code flow, revoke tokens, harden enrollment.
→
Prevent Astrana-style corporate caller-ID vishing
Astrana Health’s spoofed corporate-line employee vishing shows why transferable login secrets still fail. Phishing-proof device-bound MFA closes that path; post-access data theft does not.
→
Phishing-proof MFA closes password-only portals
Stolen passwords still open VPN, Citrix, and support portals that never ask for a second factor. Phishing-proof MFA 2.0 closes that single-factor door.
→
Phishing-proof MFA stops AiTM session theft
AiTM proxies finish password plus OTP or push on the wrong origin, then copy the session. Phishing-proof MFA 2.0 refuses that login so the kit never holds a cookie.
→
Phishing-proof MFA stops workforce MFA vishing
Helpdesk TAP resets and coached fake logins are one workforce vishing class. Phishing-proof MFA 2.0 removes the transferable secrets callers collect.
→
GhostCode: MFA cannot undo issued OAuth tokens
GhostCode victims finished real Microsoft MFA, then attackers held OAuth tokens. Phishing-proof MFA 2.0 does not un-issue tokens minted to an attacker-owned device grant.
→
Phishing-proof MFA stops M365 passkey coaching
Passkey-themed IT vishing steered M365 users into AiTM and device-code paths. Phishing-proof MFA blocks those logins; stolen tokens still need revoke.
→
Why MFA 2.0 does not undo M365 device-code theft
Midnight Blizzard device-code phishing issued M365 OAuth tokens after real Entra MFA. Login MFA does not undo that. Block device-code flow and revoke tokens.
→
Aesto Health: no MFA path in public reporting
Aesto Health's over 9.5M patient disclosure names scale, not a login path. MFA 2.0 cannot be scored until authentication or recovery facts appear in public reporting.
→
Prevent AdaptHealth contractor session social engineering
AdaptHealth lost ~4.1M patient records after contractor social engineering minted a privileged cloud session. Phishing-proof MFA 2.0 hardens that login path; post-auth session use still needs revoke.
→
Stop Entra helpdesk vishing with phishing-proof MFA
Helpdesk vishing steered Entra users into AiTM and device-code paths. Phishing-proof MFA 2.0 and protected enrollment stop the credential and attacker-MFA phases; tokens still need binding.
→
Why MFA upgrades miss device-code token handoff
Victims finished real Microsoft MFA; attackers still got tokens. Stop device-code handoff with grant limits, session controls, and SES, not factor theater.
→
MFA 2.0 stops BigBear AiTM at Entra ID login
BigBear 2.0 relayed Entra ID logins and stole M365 cookies. Phishing-proof MFA 2.0 stops the AiTM harvest at login. Cookie replay after a completed login is separate hygiene.
→
Not all passkeys are created the same DEES
SpecterOps published more than twenty Pass-the-Passkey techniques. Sixteen bear on the choice of identity provider: six are IdP failures, three are passkey misuse, six need malware on PCs. RDP is the exception CBE stops.
→
Why MFA 2.0 wouldn't stop Spring Ring vishing
Spring Ring used Teams helpdesk vishing to push RMM and malware, not login codes. Phishing-proof MFA 2.0 does not stop coached Quick Assist when no login ceremony ran.
→
Stop Mirage2FA AiTM at the Microsoft 365 login
Mirage2FA proxied Microsoft 365 logins, relayed live MFA including number matching, then stole session cookies. Phishing-proof MFA 2.0 stops that ceremony. Cookie revoke is residual.
→
DGFiP lesson: phishing-proof agent and partner login so usurped IDs cannot mint trusted tax sessions
DGFiP’s 678,000-record hit used usurped agent and third-party logins. Phishing-proof MFA 2.0 stops stolen workforce IDs from minting sessions. Live tax queries after auth are a different problem.
↻ Updated Feb 2026
→
Phishing-proof MFA 2.0 closes Entra spray and push fatigue at login
TheHatman listed ~3.64M Entra directory rows. The only named live login claim is password spray plus MFA fatigue. Phishing-proof MFA 2.0 removes that surface. Treat the marketplace pitch as an ad until proven.
↻ Updated Aug 2026
→
Phishing-proof MFA 2.0 stops TrendAI AiTM before the cookie
TrendAI MDR watched a PTO AiTM finish push or OTP, steal a Microsoft 365 cookie, and run ~30 days of cloud-only BEC with no malware. Phishing-proof MFA 2.0 stops that login. Cookie replay after malware is a different…
↻ Updated Aug 2026
→
Gunra VDI abuse: where MFA 2.0 actually helps
Gunra AA26-222A stacked Fortinet auth bypass, VDI cookie theft, and a server OTP backdoor. Phishing-proof MFA 2.0 helps on one surface. Not the other two.
→
Phishing-proof MFA stops vishing MFA code harvests
A five-week vishing wave steered employees onto spoofed logins and harvested passwords plus MFA codes across 200+ orgs. Phishing-proof MFA 2.0 removes what callers can collect.
↻ Updated Sep 2026
→
Device-bound MFA stops Payroll Pirates at login
Payroll Pirates proxied the real Microsoft login, let users finish push or OTP, and harvested the session cookie. Phishing-proof MFA 2.0 stops that login. Cookie replay after malware is a different problem.
↻ Updated Aug 2026
→
Device-bound MFA stops UNC6671 vishing AiTM
UNC6671 spoofed IT on personal mobiles, coached hedge-fund staff onto AiTM logins, and harvested Microsoft 365 and Okta sessions. Phishing-proof MFA 2.0 stops that path. Cookie replay after malware is a different…
→
Device-bound MFA 2.0 would have blocked Greatness AiTM
Greatness PhaaS sold a $289 AiTM kit that finished MFA for the attacker and minted Microsoft 365 sessions that lasted weeks. Phishing-proof MFA 2.0 stops that login. Token replay after malware is a different problem.
→
Stop IEH-style fake M365 login credential theft
IEH’s Form 8-K: fake Microsoft login page, typed workforce credentials, one mailbox open. Phishing-proof MFA 2.0 leaves that page nothing reusable to steal.
→
Device-bound MFA would have blocked Baroda email login
TripleX claimed hundreds of gigabytes after one Bank of Baroda employee mailbox opened on a weak password. Phishing-proof MFA 2.0 stops remote password-only login. Post-login bulk read is a different problem.
↻ Updated Sep 2026
→
Hardened recovery stops helpdesk MFA re-enrollment
O-UNC-034 reset passwords via helpdesk vishing, then re-enrolled attacker MFA. Phishing-proof MFA 2.0 hardens recovery; payroll diversion after takeover is residual.
→
Phishing-proof MFA stops OIT vishing Duo push
Princeton Advancement fell to OIT vishing, a fake login, and a coached Duo push. Phishing-proof MFA 2.0 closes that login path; post-auth DB access needs containment.
→
Phishing-proof MFA stops Whisper2FA M365 relay
Whisper2FA live-relays Microsoft 365 OTP and push until login succeeds. Phishing-proof MFA 2.0 blocks that path; residual cookies need revoke.
→
MFA 2.0 stops Salesforce MFA code vishing
UNC6040 vished Salesforce workforce MFA codes and connected-app consent. Phishing-proof MFA 2.0 blocks code read-outs; OAuth consent needs separate controls.
→
Phishing-proof MFA stops HR IT vishing handoffs
Workday-style HR/IT phone and text coaching seeks account access. Phishing-proof MFA 2.0 removes transferable factors; CRM reads after login stay residual.
→
Phishing-proof MFA limits CRM vishing handoff
Cisco CRM vishing abused workforce identity handover. MFA 2.0 shrinks transferable factors; export after CRM access needs revoke and access controls.
→
Stop Aflac-style helpdesk social engineering
Aflac disclosed social engineering for network access in June 2025. Phishing-proof MFA 2.0 hardens helpdesk recovery; post-access impact is residual.
→
Phishing-proof recovery stops Co-op helpdesk path
Co-op fell to helpdesk password-reset social engineering in 2025. Phishing-proof MFA 2.0 hardens recovery; NTDS and member-data theft after the reset stay residual.
→
Stop helpdesk password-reset social engineering
M&S fell to helpdesk password-reset social engineering in April 2025. Phishing-proof MFA 2.0 hardens recovery; ransomware after the reset is residual post-auth impact.
→
Phishing-proof MFA stops industrial AiTM login relay
JUMPSEC's UK industrial AiTM kits relayed workforce MFA and stole sessions live. Phishing-proof MFA 2.0 blocks that reverse-proxy login; stolen cookies still need revoke.
→
Phishing-proof MFA stops Simmons Workday path
Simmons Workday fell after credential phishing and a fraudulent MFA approval. Phishing-proof MFA 2.0 blocks that login; post-auth access is separate.
→
Would MFA stop PowerSchool PowerSource login?
PowerSchool's PowerSource breach used a password-only subcontractor login. Device-bound MFA blocks that sign-in; SIS export after auth needs other controls.
→
Stop fake Okta Support MFA token harvest
Okta warned of fake-Support phishing for passwords and MFA tokens. Phishing-proof MFA 2.0 removes transferable factors so coached harvest fails at login.
→
Prevent helpdesk MFA phone-number swap attacks
Seyfarth Service Desk swapped an employee MFA phone number after impersonation. Phishing-proof MFA 2.0 locks recovery; ADP diversion after a completed swap is residual.
→
Phishing-proof MFA stops M365 spray and push fatigue
CISA AA24-290A shows Iranian actors spraying M365 passwords and bombing push MFA. Phishing-proof MFA 2.0 closes login and enrollment; post-auth work is residual.
→
Phishing-proof MFA stops TfL helpdesk 2FA resets
TfL fell to marketplace credentials and a helpdesk 2FA reset. Phishing-proof MFA 2.0 hardens recovery; privilege use after reset is residual.
→
MFA 2.0 stops VPN vishing OTP push harvest
GuidePoint GRIT saw helpdesk vishing harvest VPN passwords, OTPs, and push. Phishing-proof MFA 2.0 closes that path; malware after login is separate.
→
Stop unsolicited MFA push approval attacks
Michigan Medicine email fell after an unsolicited MFA prompt approval. Phishing-proof MFA 2.0 removes the coachable push; post-auth mailbox access is residual.
→
Stop helpdesk MFA re-enrollment like UNC3944
UNC3944 reset workforce MFA at the helpdesk, then rode Okta SSO into SaaS. Phishing-proof MFA 2.0 hardens recovery; post-auth sessions still need revoke.
→
Phishing-proof MFA stops helpdesk password resets
Michigan Medicine lost three workforce emails to helpdesk password-reset vishing. Phishing-proof MFA 2.0 hardens recovery so callers cannot mint credentials.
→
Dropping SMS MFA removes telephony supplier logs
Duo’s telephony supplier phish exposed SMS MFA log metadata for ~1% of customers. Phishing-proof MFA ends that SMS supplier path; customer MFA cannot rewrite the vendor phish.
→
Phishing-proof MFA stops LA DMH QR M365 path
LA County DMH fell to QR-code phishing into Microsoft 365. Phishing-proof MFA 2.0 blocks transferable login factors; mailbox access after auth is residual.
→
Change Healthcare Citrix MFA blocks initial access
Change Healthcare Citrix portal had no MFA. Phishing-proof MFA 2.0 blocks password-only initial access; post-login ransomware is residual containment work.
→
MFA 2.0 stops Midnight Blizzard password spray
Midnight Blizzard sprayed a Microsoft legacy test tenant without MFA. Phishing-proof MFA 2.0 closes that gate; OAuth mailbox abuse after sign-in is residual.
→
MFA 2.0 stops Midnight Blizzard password spray
Midnight Blizzard sprayed a no-MFA Microsoft test tenant in late 2023. MFA 2.0 on every tenant path blocks that foothold; post-auth mail access is residual.
→
Stop Scattered Spider helpdesk MFA transfer
CISA AA23-320A maps Scattered Spider helpdesk MFA resets, push fatigue, and SIM swap. Phishing-proof MFA 2.0 hardens recovery; post-auth stealers stay residual.
→
Stop Okta-style support service-account passwords
Okta's 2023 support breach used a service-account password saved to personal Google. MFA 2.0 kills that secret; HAR session hijacks stay residual post-auth.
→
Harden helpdesk MFA recovery against vishing
MGM’s 2023 path hinged on helpdesk MFA factor reset after vishing. Phishing-proof MFA 2.0 hardens recovery; Okta sessions and ransomware after reset stay residual.
→
Prevent helpdesk vishing MFA reset abuse
Clorox alleged Cognizant Service Desk password and MFA resets without verification. Phishing-proof MFA 2.0 hardens recovery; post-login impact stays residual.
→
Prevent Okta Super Admin helpdesk MFA resets
Helpdesk MFA factor resets unlocked Okta Super Admins in 2023. Phishing-proof MFA 2.0 hardens enrollment and recovery; federation abuse after is residual.
→
Phishing-proof MFA stops Storm-1167 AiTM login
Storm-1167 AiTM harvested M365 logins then enrolled attacker OTP. Phishing-proof MFA 2.0 blocks that sign-in and locks enrollment; stolen cookies still need revoke.
→
Phishing-proof MFA stops Henry Ford email path
Henry Ford Health email phishing opened three employee mailboxes (~168k patients at PHI risk). Phishing-proof MFA 2.0 blocks that login; residual mail is post-auth.
→
Phishing-proof MFA stops AiTM email session theft
The Standard fell to AiTM spear-phishing of employee email despite MFA. Phishing-proof MFA 2.0 blocks that live session harvest; mailbox residual needs revoke.
→
Stop Corteva-style payroll helpdesk resets
Corteva’s ADP payroll diversion started with name-and-DOB call-center recovery. Phishing-proof MFA 2.0 hardens that reset path; misuse after the new password is residual.
→
Phishing-proof MFA stops Reddit AiTM login path
Phishing-proof MFA 2.0 stops Reddit-style AiTM employee login harvest. Once the session exists, internal document access is residual post-auth work.
→
Stop Mailchimp-style workforce credential social engineering
Mailchimp’s Jan 2023 notice: social engineering stole employee credentials used on support tooling for 133 accounts. Phishing-proof MFA 2.0 closes that path; residual access needs revoke.
→
Phishing-proof MFA stops Activision SMS path
Activision’s Dec 2022 path started with workforce SMS phishing. Phishing-proof MFA 2.0 closes that login harvest; a live Slack session after auth still needs revoke.
→
Beyond CISA number matching: phishing-proof MFA
CISA urged phishing-resistant MFA and number matching against push fatigue. Phishing-proof MFA 2.0 removes the push and OTP paths number matching only partially hardens.
→
WebAuthn stops Dropbox hardware OTP phishing
CircleCI phishing hit Dropbox via GitHub passwords and hardware OTPs. Origin-bound WebAuthn stops that harvest; session repo copy is residual.
→
Phishing-proof MFA stops Uber push fatigue
Uber’s 2022 contractor breach used MFA fatigue on push approvals. Phishing-proof MFA 2.0 blocks that login; post-login Slack and G-Suite access is residual.
→
Phishing-proof MFA stops Twilio Okta OTP harvest
Twilio 0ktapus smishing harvested employee OTP on fake Okta pages. Phishing-proof MFA 2.0 blocks that real-time login path; admin access after auth is residual.
→
Why FIDO2 stopped Cloudflare SMS Okta AiTM phishing
Cloudflare’s July 2022 SMS AiTM Okta lure phished three passwords. Mandatory FIDO2 keys blocked ATO. Phishing-proof MFA 2.0 closes the same login path.
→
Phishing-proof MFA stops Twilio employee vishing
Twilio’s June 2022 employee vishing harvested transferable credentials. Phishing-proof MFA 2.0 removes secrets staff can speak on a call; malware after login is separate.
→
Phishing-proof MFA stops Cisco push fatigue
Cisco's 2022 VPN breach used push fatigue and vishing. Phishing-proof MFA 2.0 blocks that path and attacker enrollment; AD lateral movement is residual.
→
Mailchimp employee SE: phishing-proof MFA path
Mailchimp’s March 2022 employee social engineering opened support tooling with stolen credentials. Phishing-proof MFA 2.0 blocks that login path; exports after auth stay residual.
→
Prevent Lapsus$ MFA prompt spam and SIM swap
Lapsus$ hit one Microsoft employee account via credential TTPs Microsoft documented. Phishing-proof MFA 2.0 closes prompt spam, helpdesk reset, and SIM swap at login.
→
MFA 2.0 limits after NVIDIA Lapsus$ hash theft
Lapsus$ stole NVIDIA employee passwords and ~71k NTLM hashes after foothold. MFA 2.0 does not reverse that dump. Scope prevention only to proven login paths.
→
Okta Sitel: harden support MFA enrollment
Lapsus$ RDPed a Sitel Okta support session for ~25 minutes. MFA 2.0 does not undo that live session. Hardened enrollment still shrinks factor-add risk.
→
Require phishing-proof MFA on O365 OWA
Healthplex O365 mail opened after a fake fax lure because MFA was off on OWA. Phishing-proof MFA 2.0 blocks password-only web mail; mailbox NPI is residual.
→
MFA 2.0 stops Robinhood-style support vishing
Robinhood’s 2021 support phone vishing issued console access. Phishing-proof MFA 2.0 hardens that workforce path; data reads after access remain residual.
→
Stop university Duo SMS OTP phishing
Proofpoint tracked university Duo SMS OTP phishing in 2021. Phishing-proof MFA 2.0 removes typed codes on spoofed pages; mailbox relay shrinks when login harvest fails.
→
Prevent Weill Cornell-style mailbox phishing
Weill Cornell employee email fell to phishing in 2021. Phishing-proof MFA closes that login path; residual PHI in opened mailboxes is post-auth work.
→
Phishing-proof MFA stops Luminis email login
Luminis Health tied 2021 employee mailbox access to phishing. Phishing-proof MFA 2.0 hardens that login; open-mailbox data exposure is residual post-auth.
→
Phishing-proof MFA stops Mon Health email path
Mon Health phishing opened workforce mailboxes. Phishing-proof MFA 2.0 stops that remote-email login; BEC after ATO is residual impact no MFA undoes.
→
Prevent helpdesk lost-phone MFA token handoffs
EA IT handed MFA tokens after a lost-phone Slack story. Phishing-proof MFA 2.0 hardens enrollment and recovery so chat-only proofing cannot re-issue a usable factor.
→
MFA 2.0 stops Colonial legacy VPN password login
Colonial Pipeline's DarkSide path used a password-only legacy VPN. MFA 2.0 blocks that login; ransomware after the tunnel is residual post-auth work.
→
Phishing-proof MFA blocks CHKD-style email takeover
CHKD’s 2021 employee email phishing opened PHI-holding mailboxes. Phishing-proof MFA 2.0 stops that login path; reading mail after takeover is residual.
→
Phishing-proof MFA blocks UCSD Health email login
UC San Diego Health employee email fell to multi-month phishing ATO. Phishing-proof MFA 2.0 blocks that login; post-login mailbox reading needs revoke, not a stronger prompt.
→
Phishing-proof MFA stops Oldsmar SCADA remote path
Oldsmar’s 2021 water SCADA incident used password-only remote access. Phishing-proof MFA 2.0 blocks shared remote secrets at login; console abuse after auth is residual.
→
Phishing-proof MFA stops WMed email takeover
WMed’s Jan 2021 phishing opened one employee mailbox and ~2,474 notices. Phishing-proof MFA blocks that login; mail already read after takeover is residual.
→