You have to invite them in
Summary: Cisco Talos' 2025 Year in Review identifies attacks on identity as the dominant theme, with attackers seeking to be invited in as a recognizable user rather than breaking in through exploits. Talos reports that nearly a third of MFA spray attacks in 2025 targeted identity access management applications, alongside a 178% surge in fraudulent device registration events, with common techniques including victims reading out MFA codes in real time and adversary-in-the-middle phishing kits proxying legitimate login pages to capture one-time codes.
Key Takeaway: The code is valid, the authentication succeeds and the session is issued - so a 178% surge in fraudulent device registration means attackers are targeting the mechanisms that issue invitations in the first place, and your MFA may be doing exactly what it was designed to do while an intruder operates as if they own the place.
Read the original at Cisco Talos ↗
- Topics
- Malware
- Related
- ARTEX and beyond: AI-enabled penetration testing platforms Cyber Risks · Nov 13, 2026Fake GTA 6 download goes after Steam logins and crypto wallet data Cyber Risks · Nov 13, 2026Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins Cyber Risks · Nov 13, 2026