MFA Is Enabled. They Got In Anyway.

# MFA Is Enabled. They Got In Anyway. Listen, kid, stop staring at the attribution slides. I don't care if it's Iran, North Korea, or some teenager in a basement with too much caffeine. Attribution is for the lawyers and the politicians who want to feel like they're doing something. When you're in the middle of a breach, the only thing that matters is the blast radius and whether your backups are actually immutable or just "stored on another server." Take this device code phishing garbage hitting Microsoft and Salesforce accounts. It’s a beautiful piece of efficiency because it doesn't try to break the lock; it just convinces the owner to hand over the key while they think they're still holding it. The claim here is that MFA is our ultimate shield. The evidence—this surge in device code abuse—proves we’ve just built a higher wall with a gap at the bottom. By abusing OAuth 2.0, attackers are tricking users into entering a code on a legitimate Microsoft page, bypassing the very MFA we spent five years and millions of dollars deploying. The implication is simple: if you're relying on "MFA enabled" as a checkbox for your security audit, you're lying to yourself. You might think your conditional access policies stop this. They don't. Device code was designed for things that can't easily use a browser—like an old printer or a smart TV. Attackers are just pretending to be a printer. The second-order effect here isn't just the lost account. It’s the trust. Once an attacker is in via a device code, they aren't just stealing emails; they're pivoting into the tenant, granting themselves permissions, and creating persistence that will survive a password reset. They're not knocking; they've already moved into the guest room. It reminds me of the early days—back when Code Red was tearing through IIS servers. We thought we had the perimeter handled until we realized the perimeter was an illusion. The only difference now is the scale. Then we have the Adform script poisoning. This one is a classic supply chain hit, but with a direct financial punch. Attackers compromised a JavaScript file to swap cryptocurrency wallet addresses on customer sites. Think about the blast radius there. It isn't just Adform that's burned; it's every single client who trusted that script to run on their front end. The marketing teams are probably thrilled that their "optimization" tool is currently acting as a vacuum for their customers' funds. When you outsource your frontend logic to a third party, you aren't just buying a service—you're inviting a stranger to rewrite your website in real-time. I’ve seen this movie before. NotPetya showed us that one bad update could brick half the shipping industry in a weekend. This is the same principle, just shifted from the OS level to the browser level. If you want to see how bad a Tuesday can get, look at the water facilities. We’ve got Minnesota and Wisconsin on high alert because of a wave of attacks on their systems. The suits are arguing about "moderate confidence" that Iran is behind it. Again: who cares? Whether it's a nation-state or a script kiddie, the result is the same. If your PLC (programmable logic controller) is exposed to the public internet, you’ve essentially put a "Welcome" mat out for anyone with a basic scanner. The cost of this on a Tuesday isn't a data leak; it's potentially having to tell a town that their water is toxic or non-existent. That's a different kind of pressure than explaining a database leak to a board of directors. The numbers from the wire today are just depressing. We saw 66 data breaches hit the tape today alone. The technology sector remains the primary target, ranking #1 for the week with 222 stories, including 50 new incidents today. Then you have things like the Paidwork breach, where north of 23 million user records were exposed. Twenty-three million. That's not a "sophisticated" attack. You don't need to be an APT to dump a database if the permissions are wide open. Every time I see the word "sophisticated" in a post-breach statement, I assume the company is trying to hide the fact that they forgot to rotate their API keys for three years. Stop looking for the silver bullet. There isn't one. The real question you should be asking is this: if your primary identity provider went dark or became compromised tomorrow morning, how long would it take before you realized you were locked out of your own house? Most of you aren't pricing in the cost of a total identity collapse. You're too busy worrying about the next CVE. Go check your logs for unusual OAuth grants. Then go check if your backups are actually offline.