TLDR Tech / InfoSec
The attack dominating financial services doesn't steal passwords. It resets MFA and steals the token
Three independent reports from CrowdStrike, the FBI, and Verizon converge on the same finding: the attacks dominating financial services bypass password theft entirely, with Mutant Spider running Microsoft Teams vishing to trick help desks into resetting MFA and registering attacker devices, the $250-a-month Kali365 phishing-as-a-service platform capturing M365 OAuth tokens through the legitimate device code flow, and credential theft falling to just 13% of breach initial-access vectors behind vulnerability exploitation at 31%. MFA fires on the victim's device and not the attacker's, so captured tokens become credential-equivalent bearer artifacts granting weeks or months of silent access that traditional credential-theft monitoring never flags. Defenders should require out-of-band verification and FIDO2 keys for all MFA resets, restrict the device code flow via Entra ID conditional access, monitor OAuth refresh-token use from unfamiliar devices, and audit Graph API access for bulk operations from reset or device-code sessions.
Read the full story