Beers with Talos, Ep. #120: How attackers are finding ways around MFA
Summary: Beers with Talos episode No. 120, recorded April 6, 2022, features Cisco Talos Incident Response's Nate Pors discussing how attackers use "prompt bombing" to trick users into approving MFA requests and other methods of getting around multi-factor authentication. The episode also covers the FBI's takedown of the Cyclops Blink wireless router malware, with the crew reflecting on VPNFilter, and notes that Lapsus$ and the SolarWinds attackers used the same prompt-bombing technique.
What's compelling: Prompt bombing turns your own MFA prompt into the attack surface, and the source ties the technique to both Lapsus$ and the SolarWinds attackers - actors who have already operated inside major enterprises.
Read the original at Cisco Talos ↗
- Topics
- Detection & Response
- Related
- YARA-X 1.23.0 Release, (Sun, Nov 15th) Cyber Risks · Nov 15, 2026Inside Falcon AI Gateway: One Control Point for AI Traffic Cyber Risks · Nov 13, 2026Macfinger Click Fix campaign sends Down TheDRAIN infostealer for macOS, (Fri, Nov 13th) Cyber Risks · Nov 13, 2026