aitm

MFA Isn't the Final Barrier Anymore. It Hasn't Been for a While.

John Z Black Apr 10, 2026

Security Operations & Resilience #mfa #phishing #aitm #fido2 #chrome-dbsc #venom-phaas #unc6783 #infostealers #identity-security

Three research teams this week documented MFA failures at login, at the helpdesk layer, and post-session. The answer isn't more MFA. It's hardware-bound authentication.

Europol Took Down Tycoon2FA. It Was Back in Days, and Smarter Than Before.

John Z Black Mar 31, 2026

Ransomware & Cybercrime #phishing #tycoon2fa #phishing-as-a-service #microsoft-365 #entra-id #conditional-access #mfa #aitm #europol #crowdstrike

Tycoon2FA's rapid return after Europol's March 4 takedown shows why seizing infrastructure doesn't shut down phishing platforms. The operators pre-staged backup infrastructure before the first domain was seized.

Your MFA and Your ZIP Scanner Both Have Blind Spots Attackers Are Already Using

John Z Black Mar 12, 2026

Security Controls #mfa #phishing #aitm #starkiller #zombie-zip #fido2 #passkeys #security-controls #defense

Adversary-in-the-Middle phishing beats standard MFA in real time. Zombie ZIP tricks archive scanners into waving malware through. Two trusted security controls, two systematic bypasses already in the wild.