Around 20 March 2024, a Los Angeles County Department of Mental Health employee scanned a QR code from a phishing email attachment and reached a malicious site that enabled Microsoft 365 account takeover. According to the California OAG breach notice, county notices describe an MFA credential reset and say Microsoft was notified of an MFA vulnerability exploited in the attack. Closing the phishable workforce login stops that credential path. Mailbox access after a live session already exists is residual post-auth work no login MFA undoes.
For the full attack-chain write-up, read the companion on legacymfa.sucks.
FAQ
Would phishing-proof MFA have stopped the LA County DMH QR path?
Yes at login. Phishing-proof device-bound MFA 2.0 removes transferable passwords, OTP codes, and push approvals from workforce Microsoft 365 sign-in, so a QR-delivered malicious site cannot finish a remote login the way legacy MFA allows. County notices already place the failure on MFA at access time. Once attackers already hold a live mailbox session, reading mail and related PHI is post-authentication access. Revoke and credential reset remain hygiene there, not a substitute for prevention upstream.
Why do QR lures still defeat OTP and push on Microsoft 365?
A QR code moves the victim off careful email inspection and onto a phone browser aimed at an attacker-controlled origin. If the second factor is something a user can type, approve, or relay, the attacker in that login path can capture or complete it live. Device-bound, origin-bound signatures never leave the enrolled hardware and never satisfy the wrong site. That is prevention, not detection: the harvestable factor is gone before the QR lure matters.
Do passkeys alone close QR phishing of county Microsoft 365?
Passkeys are phishing-resistant at the login ceremony when the deployment actually requires them end to end. They still leave a gap if enrollment, recovery, or fallback keeps email codes, SMS, or other transferable secrets. MFA 2.0 is phishing-proof across the identity lifecycle, not only at authentication. Public reporting does not establish which factors LA County DMH had enrolled in March 2024. It only shows notices blamed an MFA weakness when the malicious site enabled account access.
What does MFA 2.0 not undo after the mailbox session exists?
MFA 2.0 does not kill an already-issued Microsoft 365 session or stop an attacker who already opens workforce mail. That residual is containment: revoke sessions, reset credentials, and review mailbox access for PHI exposure. Fooling a user into a malicious login path is easy compared with planting malware on a machine that already holds a legitimate session. For the LA County DMH case, the prevention claim is closing the phishable login so the session is never minted for the attacker in the first place.
What should public-health IT change after this incident?
Require device-bound, phishing-proof authentication for workforce Microsoft 365 so QR attachments and other malicious sites have no transferable factor to harvest. Treat post-incident MFA credential resets as response, not as proof the old factor model was sound. Keep session revoke and mailbox audit for anything that happens after authentication. The device-bound architecture keeps private keys off the network and off the wrong origin, which is the control that matches this QR-to-login failure mode.
