Want some techniques that many Red Teams have been using to circumvent MFA protections on accounts? Yeah, even “unphishable” versions.

I’m sharing so that you can think about what’s coming, how you’ll do mitigations, etc. Its being seen in the wild more these days.

🧵1/n

— _MG_ (@_MG_) March 23, 2022

MFA is worthless if your user just gives the attacker the MFA code over the phone, as one of the users at a company for which I do consulting decided to do. Yeah, I can’t figure it out either. But the rule of IT is that users are gonna do things you think they will never, ever do, even if you’ve told them not to do that very thing repeatedly.