How are attackers trying to bypass MFA?
Summary: Cisco Talos' Incident Response Quarterly Trends report for the first quarter of 2024 found MFA involved in nearly half of all incidents the team responded to, with users accepting fraudulent push notifications as the underlying cause in 25% of engagements and improper MFA implementation in 21%. In Cisco Duo's dataset of 15,000 catalogued push-based attacks from June 2023 to May 2024, 5% of sent push attacks were accepted, most acceptors received between one and five requests, and the majority of attempts arrived between 10:00 and 16:00 UTC, with a U.S. peak between 8 and 9 a.m. EST.
Key Takeaway: Five percent of fraudulent pushes were accepted, and most of those users gave in after only one to five requests - a small number of attempts timed to the morning login window is enough. Talos also points to phishing-as-a-service kits like Tycoon 2FA, which capture session cookies through an attacker-in-the-middle server so stolen sessions replay even after credentials are changed.
Read the original at Cisco Talos ↗
- Topics
- Identity & Access Management
- Related
- FBI flash alert says Artex tool automating cyberattacks at ‘machine speed’ Cyber Risks · Nov 13, 2026Connect Wise Cloud Backup application abused in cross-tenant token sweep Cyber Risks · Oct 19, 2026Sponsored: Specter Ops on the impact of AI agents on Blood Hound Cyber Risks · Sep 20, 2026