3 Famous Breaches That Started With MFA Phishing
MFA phishing is no longer a niche technique. In October 2025 alone, Microsoft blocked more than 13 million phishing emails tied to a single kit called Tycoon 2FA. That’s one phishing-as-a-service platform, in one month. Two-factor authentication was supposed to stop this kind of attack cold. Instead, attackers found a way to weaponise the trust users place in that second step. Rather than stealing a password and hoping it still works, it takes a more direct route. It intercepts or tricks users into handing over the one-time code or approval that grants full access. In short, what was once a reliable defence has become a new attack surface. Three major breaches show exactly how it happens. How MFA Phishing Actually Works MFA phishing falls under real-time phishing and adversary-in-the-middle, or AiTM, techniques. Instead of stealing stored credentials, attackers aim to intercept the codes or approvals a user provides in the moment. It usually plays out in four steps. 1. Initial phishing or redirection. The victim gets a phishing email or lands on a spoofed login page. Often, it’s a near-perfect copy of a Microsoft 365, Okta, or Google Workspace login screen. 2. Simultaneous proxying. Behind the scenes, the fake page connects to a real-time relay tool, like EvilProxy or Modlishka. The attacker forwards the victim’s credentials to the real service, and the MFA challenge comes back through the same channel. 3. Real-time prompt theft. The victim enters their code or approves a push notification, believing they’re logging in securely. Meanwhile, the attacker completes the same login in parallel and gains full access. 4. Session token harvesting. In more advanced versions, attackers extract and reuse session tokens or cookies. This lets them skip further MFA challenges entirely, until the token expires. 3 Famous Breaches That Started With MFA Phishing These aren’t hypothetical scenarios. Each of the following breaches was confirmed publicly and documented by security researchers. Uber, 2022. An attacker linked to the Lapsus$ group bought a contractor’s stolen password on the dark web. From there, they triggered dozens of MFA push notifications, sending around 40 in just 30 minutes. Posing as Uber IT support, the attacker messaged the contractor and said approving one would make the notifications stop. Exhausted, the contractor tapped approve. Within minutes, the attacker had access to Uber’s internal Slack, VPN, and source code repositories. Cisco, 2022. This attack combined MFA push bombing with old-fashioned vishing. First, the attacker compromised an employee’s personal Google account, where Cisco credentials had synced via a browser. From there, they pushed repeated MFA prompts to the employee’s phone. That didn’t work right away, so they followed up with phone calls, posing as trusted support staff in different accents. Eventually, the employee accepted a push. The attacker, linked to Yanluowang ransomware operators, gained VPN access and exfiltrated internal files. Reddit, 2023. A phishing site cloned Reddit’s internal intranet login. Unlike simple credential phishing, this page was built to capture both the employee’s password and their MFA token at once. It relayed both to Reddit’s real login system before the token expired. That’s textbook AiTM. As a result, the attacker accessed internal documents and source code, though Reddit confirmed user passwords weren’t exposed. Why MFA Phishing Works So Well Several factors make this technique so effective: How to Stop MFA Phishing Move to phishing-resistant MFA. TOTP codes and push notifications can both be relayed. FIDO2 and WebAuthn credentials, by contrast, are cryptographically bound to the device and the site origin. Because of this, a cloned login page simply can’t use them. CISA and NIST classify FIDO2 security keys and platform authenticators as the only genuinely phishing-resistant options available today. Add contextual authentication. Risk-based policies help catch what a stolen token alone won’t. For example, if a login comes from an unusual location or an unrecognized device, the system should force step-up verification, or block it outright. Shorten token lifespans. Limiting how long a session token stays valid narrows the attacker’s window. Re-authentication policies and token binding also help prevent reuse altogether. Deploy inline threat detection. Services that detect known phishing kits and AiTM proxies can catch an attack before a user ever reaches the fake page. In addition, DNS filtering and browser isolation add further layers. Train users to notice red flags. Being asked to enter a code twice is one warning sign. So is an MFA prompt that arrives out of context, or a slightly altered domain, like “micr0soft-login.com.” Security awareness training still matters, even with stronger technical controls in place. Audit logs and revoke tokens fast. Watch authentication logs for logins from multiple regions or IPs in a short window. Once something looks wrong, revoke the session immediately rather than waiting to investigate first. Why Phishing-Resistant MFA Is the Real Fix The industry is already moving this direction. According to the FIDO Alliance’s State of Passkeys 2026 report, 68% of organizations have deployed or are actively deploying passkeys for workforce sign-in. Globally, roughly 5 billion passkeys are now in active use. On the consumer side, 48% of the top 100 websites now offer passkeys, more than double the 2022 figure. The payoff is significant. Microsoft’s Digital Defence Report 2025 found that phishing-resistant MFA blocks more than 99% of identity-based attacks. Notably, that holds true even when an attacker already has a valid username and password. In other words, that’s the gap between MFA that merely exists and MFA that actually holds up against AiTM. MFA Phishing Means MFA Alone Isn’t Enough Fake MFA prompts are a wake-up call. Trust has to be verified continuously, not just at the moment of login, but across the entire session lifecycle. As attackers refine AiTM and token-theft techniques, relying on legacy TOTP and SMS-based MFA becomes riskier every year. The convenience of push-based MFA should never outweigh its risks when it’s deployed without hardening. At this point, trusting an MFA prompt blindly is nearly as risky as trusting a password alone. So organizations need both pieces: phishing-resistant authentication, and users trained to spot deception.
RASP: Rethinking Application Security from the Inside Out
In a digital world that runs on applications, defending software has never been more critical. Traditional security tools struggle to keep up with modern threats, which are more targeted, more complex, and increasingly subtle. Runtime Application Self-Protection (RASP) offers a smarter, more integrated solution. It is not merely a new product category; it is a significant shift in how we think about securing software. The Evolution: From Reactive Walls to Embedded Defences To understand RASP’s value, it helps to trace its roots. Application security has always evolved in tandem with software development trends. This environment led to the birth of RASP, introduced as a concept around 2012 by pioneers in the application security space. The idea was to move the guard from the gate to the inside of the application. RASP would sit within the application runtime and understand it from the inside, using context that external tools lacked. Rather than inspecting inputs and guessing intentions, RASP could observe how data was used and decide in real time whether an operation was safe. This marked a shift from reactive defence to proactive protection built into the very fabric of the application. What is RASP? Runtime Application Self-Protection is a technology that runs inside an application and monitors its behaviour as it executes. It has a direct view into the code, data, and configuration, allowing it to detect and block threats in real time. Whereas a WAF sees a request and judges based on signatures, RASP sees what the application does with that request. If a user input is sent directly to a database query constructor, RASP can block the execution if it detects suspicious patterns like SQL injection. This intelligence gives RASP the ability to respond immediately by logging the incident, alerting administrators, or blocking the attack outright. Global Momentum As the complexity of software continues to grow, global organisations are looking to solutions that do not just detect threats but actively respond to them. RASP in the African Context In Nigeria and across Africa, the application landscape is unique. Many platforms are API-heavy, mobile-first, and deployed in cloud environments. Security teams are often lean, and applications change frequently. This creates an ideal scenario for RASP to add value. Imagine a fintech startup in Lagos handling mobile payments. They push new features every two weeks and integrate multiple third-party APIs. A traditional WAF would struggle to keep pace with these changes, but RASP could adapt instantly to new code logic and protect against misuse in real time. Or consider a healthtech platform managing patient records in Nairobi. A RASP layer could ensure that only authorised operations are performed on sensitive data, catching misuse or tampering attempts even if the attacker has valid credentials. RASP is especially effective where infrastructure is shared, IT staff is limited, or threat detection needs to happen without delay. For many African businesses, it offers a leapfrog opportunity into modern application security without needing massive overhead. Where RASP Fits in the Security Ecosystem RASP is part of a broader application security strategy. It does not replace testing or static analysis, but it complements them in important ways. It is particularly effective in protecting against zero-day vulnerabilities, business logic abuse, insider threats, and runtime exploitation. It also offers visibility into how applications behave under attack, enriching your overall security telemetry. Challenges and Misconceptions While RASP is powerful, it is not without limitations. Some concerns include: As the technology matures, these issues are being addressed. The trend is toward RASP tools that are language-agnostic, DevOps-friendly, and scalable across distributed environments. The Future of RASP The road ahead for RASP includes: As digital services grow more critical, users become more demanding, and attackers more creative, embedded application security will no longer be optional. RASP will become standard for businesses that take software reliability seriously. Security from the Inside Out RASP reflects a fundamental shift in mindset. Rather than building taller walls, it teaches the application to defend itself. This aligns with the future of cybersecurity: one where systems are intelligent, adaptive, and resilient. As more Nigerian, African, and global organisations prioritise secure digital experiences, the question is not whether RASP should be considered. It is how soon it can be integrated. How Cloud Technology Hub Can Help Cloud Technology Hub helps businesses integrate adaptive, intelligent security solutions like RASP into their development workflows. Whether you’re launching a fintech app, managing sensitive user data, or scaling across multiple environments, we support you in building secure applications from day one. Visit www.technohub.cloud or reach out to us at info@technohub.cloud to explore how we can make application security a core strength of your technology strategy. Read More Here
