Technotron
Elite member
Elite member
Leave a rep and a like
Hidden Content
The biggest shift in intrusions over the last three years isn't a new exploit or some exotic tooling. It's that attackers stopped trying to break in and started logging in. Identity based attacks, where the credential is the exploit, now dominate real world incidents, and the specific pattern that works is well documented in the incident response reports published by Microsoft, Mandiant and CrowdStrike. Here's the actual playbook, so you can recognize it happening to you or your company.
The entry almost always starts with one of three sources. A purchased credential from a stealer log, a phished password with a proxy MFA server, or a tired help desk agent. The first two are self explanatory, so let me explain the third, because it's the underrated one. An attacker who knows an employee's name, phone number and job title from LinkedIn calls the internal help desk, claims to be that employee, lost their phone on vacation, needs a temporary MFA re-enrollment. Companies with weak verification processes just do it. This is documented repeatedly in real incidents and it's the single most effective technique against otherwise well defended organizations.
Once they have the password and one MFA approval, the play is repetition. MFA fatigue, also called push bombing, is sending push notifications to the user's phone repeatedly, at odd hours, with the expectation that annoyance leads to approval. The user approves the 20th push at 2am just to make it stop. This is exactly how the 2022 Uber breach happened, and it's been repeated in dozens of published incidents since.
The countermeasure that actually stops this is number matching, where the push notification shows a number and the user has to type it into their phone. It sounds trivial, but it kills the fatigue attack because the attacker needs the number from the screen. Microsoft's own data showed number matching reduced successful push fraud dramatically, and it's now default in most Entra ID configurations.
But the advanced crews already adapted. The current state of the art is the adversary in the middle phishing kit. Tools like Evilginx2 and EvilnoVNC host a pixel-perfect copy of the real login page, proxy the credentials to the real service in real time, capture the MFA code, and relay it, all within the same session. The user never knows, they log in successfully and land in their real inbox. What the attacker keeps is not the password, it's the session cookie, and a session cookie is more powerful than a password because it skips MFA entirely.
Token theft is the current endgame. Instead of replaying authentication, malware like Redline and Lumma grabs browser cookies and the tokens stored in the machine's credential store, ships them to a panel, and the buyer logs in as the victim with no password, no MFA, nothing. This is why the same groups buying stealer logs from 2022 are now running enterprise intrusions in 2026, because the token works.
Defending against this class is different from defending against malware. Here's what actually works, in order of impact.
Phishing resistant MFA, meaning FIDO2 hardware keys or Windows Hello for Business. These bind the authentication to the actual website origin, so an adversary in the middle proxy can't replay them. YubiKeys are the standard answer and the single most cost effective security control an enterprise can buy.
Conditional access that evaluates device compliance, location and risk signals. A login from a residential IP proxy on a device that's never been seen before, at 3am, in a country where the company has no employees, should be challenged or blocked automatically.
Session token protection, which is the boring technical answer that actually matters. Short session lifetimes, re-authentication for sensitive operations, and token binding where the platform supports it.
And help desk procedures, which is the most neglected control. Video verification for identity, manager approval for MFA resets, a cooling off period, and logging every reset with the identity of who requested it. The Uber breach cost them hundreds of millions in remediation. A video call to verify identity costs nothing.
The uncomfortable truth is that most organizations have invested millions in endpoint security and almost nothing in identity security, and the attackers noticed. The perimeter isn't the network anymore, it's the login page, and the login page is defended by human habits as much as technology.
@Techn0tron
Hidden Content
The biggest shift in intrusions over the last three years isn't a new exploit or some exotic tooling. It's that attackers stopped trying to break in and started logging in. Identity based attacks, where the credential is the exploit, now dominate real world incidents, and the specific pattern that works is well documented in the incident response reports published by Microsoft, Mandiant and CrowdStrike. Here's the actual playbook, so you can recognize it happening to you or your company.
The entry almost always starts with one of three sources. A purchased credential from a stealer log, a phished password with a proxy MFA server, or a tired help desk agent. The first two are self explanatory, so let me explain the third, because it's the underrated one. An attacker who knows an employee's name, phone number and job title from LinkedIn calls the internal help desk, claims to be that employee, lost their phone on vacation, needs a temporary MFA re-enrollment. Companies with weak verification processes just do it. This is documented repeatedly in real incidents and it's the single most effective technique against otherwise well defended organizations.
Once they have the password and one MFA approval, the play is repetition. MFA fatigue, also called push bombing, is sending push notifications to the user's phone repeatedly, at odd hours, with the expectation that annoyance leads to approval. The user approves the 20th push at 2am just to make it stop. This is exactly how the 2022 Uber breach happened, and it's been repeated in dozens of published incidents since.
The countermeasure that actually stops this is number matching, where the push notification shows a number and the user has to type it into their phone. It sounds trivial, but it kills the fatigue attack because the attacker needs the number from the screen. Microsoft's own data showed number matching reduced successful push fraud dramatically, and it's now default in most Entra ID configurations.
But the advanced crews already adapted. The current state of the art is the adversary in the middle phishing kit. Tools like Evilginx2 and EvilnoVNC host a pixel-perfect copy of the real login page, proxy the credentials to the real service in real time, capture the MFA code, and relay it, all within the same session. The user never knows, they log in successfully and land in their real inbox. What the attacker keeps is not the password, it's the session cookie, and a session cookie is more powerful than a password because it skips MFA entirely.
Token theft is the current endgame. Instead of replaying authentication, malware like Redline and Lumma grabs browser cookies and the tokens stored in the machine's credential store, ships them to a panel, and the buyer logs in as the victim with no password, no MFA, nothing. This is why the same groups buying stealer logs from 2022 are now running enterprise intrusions in 2026, because the token works.
Defending against this class is different from defending against malware. Here's what actually works, in order of impact.
Phishing resistant MFA, meaning FIDO2 hardware keys or Windows Hello for Business. These bind the authentication to the actual website origin, so an adversary in the middle proxy can't replay them. YubiKeys are the standard answer and the single most cost effective security control an enterprise can buy.
Conditional access that evaluates device compliance, location and risk signals. A login from a residential IP proxy on a device that's never been seen before, at 3am, in a country where the company has no employees, should be challenged or blocked automatically.
Session token protection, which is the boring technical answer that actually matters. Short session lifetimes, re-authentication for sensitive operations, and token binding where the platform supports it.
And help desk procedures, which is the most neglected control. Video verification for identity, manager approval for MFA resets, a cooling off period, and logging every reset with the identity of who requested it. The Uber breach cost them hundreds of millions in remediation. A video call to verify identity costs nothing.
The uncomfortable truth is that most organizations have invested millions in endpoint security and almost nothing in identity security, and the attackers noticed. The perimeter isn't the network anymore, it's the login page, and the login page is defended by human habits as much as technology.
@Techn0tron
Attachments
Technotron's signature
