Threat Source newsletter (May 12, 2022) — Mandatory MFA adoption is great, but is it too late?
Summary: GitHub announced that all contributors must enroll in MFA by 2023, and Google said on World Password Day that it would soon make MFA compulsory for all users. The newsletter notes that adversaries already intercept SMS-sent MFA codes and use "prompt bombing" to get users to approve MFA prompts, while one-time codes are giving way to FIDO and certificate-based PKI authentication.
Bottom line: Attackers have already worked around the MFA that major providers are only now making mandatory, so the control you are rolling out may be the one adversaries have spent years learning to defeat.
Read the original at Cisco Talos ↗
- Topics
- Threat Actors & Nation-State
- Related
- University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026Hackers compromise 4,800 GitHub accounts to steal cloud credentials Cyber Risks · Nov 12, 2026