Phishing and MFA exploitation: Targeting the keys to the kingdom
Summary: Cisco Talos reports that in 2025 phishing was used for initial access in 40% of incidents, with attackers running cascaded campaigns that leverage a compromised account's trust to phish partners and third parties. Device compromise rose 178%, largely through voice phishing that tricks administrators into registering malicious devices, and nearly a third of MFA spray attacks targeted identity and access management applications.
Key Takeaway: Attackers abused Microsoft 365 Direct Send to spoof internal addresses and send lures from inside the organization without compromising a real account, and a successful MFA attack could let them change user roles, credentials, or the MFA policies themselves.
Read the original at Cisco Talos ↗
- Topics
- Identity & Access Management
- Related
- FBI flash alert says Artex tool automating cyberattacks at ‘machine speed’ Cyber Risks · Nov 13, 2026Connect Wise Cloud Backup application abused in cross-tenant token sweep Cyber Risks · Oct 19, 2026Sponsored: Specter Ops on the impact of AI agents on Blood Hound Cyber Risks · Sep 20, 2026