#MFA Bypass
All CosmicBytez Labs articles tagged #MFA Bypass, across news, security advisories, how-to guides, and projects.
- News
SonicWall Patches Exploited SonicOS Flaw That Weakens VPN Logins
CVE-2026-19868 lets attackers with credentials for another login method bypass SAML checks, including SAML-enforced MFA. CISA has added it to KEV.
- News
Qilin and INC Ransomware Groups Exploit Palo Alto Networks Flaw to Bypass MFA
Palo Alto Networks says ransomware actors keep exploiting patched PAN-OS and Prisma Access flaw CVE-2026-0257 to bypass MFA and reach vCenter and ESXi.
- News
Fake ChatGPT, Gemini, and Claude Ad Portals Capture Credentials and MFA Codes
Island researchers disclosed a human-operated phishing platform impersonating ChatGPT, Gemini, and Claude ad portals to steal logins and MFA codes.
- News
CTM360 Research Reveals How Insurance Phishing Has Evolved Into Real-Time Account Hijacking
New research from CTM360 shows that phishing campaigns targeting insurance and financial portals have moved beyond simple credential harvesting. Attackers...
- News
ARToken PhaaS Exposes EvilTokens' Microsoft 365 Phishing Toolkit with AI-Powered BEC
Cisco Talos has uncovered ARToken, a Phishing-as-a-Service platform affiliated with EvilTokens that weaponizes Microsoft's OAuth device code flow to...
- News
Hackers Target Microsoft 365 Accounts with 81 Million Login Attempts
A two-week password-spray campaign generated over 81 million Microsoft 365 login attempts against 64 organizations, exploiting misconfigured MFA policies...
- News
Hackers Bypass SonicWall VPN MFA Due to Incomplete Patching
Threat actors brute-forced credentials and bypassed multi-factor authentication on SonicWall Gen6 SSL-VPN appliances to deploy ransomware tools,...
- News
Tycoon2FA Hijacks Microsoft 365 Accounts via Device-Code
The Tycoon2FA phishing-as-a-service platform has added device-code phishing to its arsenal and abuses Trustifi click-tracking URLs to bypass Microsoft 365...
- News
Why Simple Breach Monitoring Is No Longer Enough
Infostealers are harvesting credentials and session cookies at scale, quietly bypassing MFA and traditional defenses. Here's why organizations need...
- News
Europol-Coordinated Action Dismantles Tycoon2FA — 330
An international coalition led by Europol and Microsoft has taken down Tycoon2FA, a phishing-as-a-service platform responsible for 87.5 million phishing...