⚠ 103 documented legacy MFA failures — and counting.

Legacy MFA Hall of Shame

It got phished or bypassed.
Again.

A running record of every breach where SMS codes, OTP apps, and push notifications got bypassed, stolen, or simply ignored. No spin. Just receipts.

The Breach Log

Canadian help-desk vishing stole M365 sessions
AL26-028 help-desk vishing steered Canadian staff onto branded AiTM pages that relayed passwords and conventional MFA into live Microsoft 365 sessions, then attacker MFA and theft.
→
SkyW4lker device-code phishing harvested M365 OAuth tokens
SkyW4lker coached Microsoft 365 users through real OAuth device authorization so access and refresh tokens landed on attacker sessions after legitimate sign-in.
→
Teams fake IT support drove 400+ RMM incidents
Arctic Wolf tracked 400+ incidents where fake IT on Teams external chat coaxed staff into Quick Assist and other RMM tools for hands-on access.
→
Huntress M365 token replay hit 79 organizations
Huntress tracked a ten-week Microsoft 365 token replay campaign: 497 successes across 79 orgs after AiTM relays and device-code phishing stole sessions.
→
QuickLaunch SSO issued tokens on wrong passwords
QuickLaunch university SSO handed valid tokens on wrong passwords via a WSO2 STS flaw, plus reset and account-creation gaps. ~32,400 user records hit.
→
LiteLLM PyPI attack via stolen GitHub tokens
LiteLLM’s Oct 2026 supply-chain breach used an unrevoked Agent Platform master key and stolen post-2FA GitHub CLI OAuth tokens to ship malicious litellm 1.107.0 for ~2 hours.
→
M365 SSPR vishing harvested employee SMS codes
Sophos X-Ops tracked M365 SSPR vishing where an employee read an SMS MFA code aloud. Attackers reset the password, minted a PRT, and hit SharePoint and ServiceNow.
→
ConnectWise SkyKick OAuth secret hit M365 tenants
Attackers used a ConnectWise Cloud Backup (SkyKick) multi-tenant OAuth app secret for app-only Graph sign-ins into customer M365 tenants. Huntress saw 162+ tenants hit.
→
BeyondTrust RS zero-day auth bypass to root
ARMORY CASTLE used CVE-2026-102764 on BeyondTrust Remote Support for unauthenticated file ops, SAWFLY root, vault attempts, then admin-console Jump Item sessions.
→
ETS SFTP credential exposed California student data
A compromised ETS SFTP login copied California CAASPP/ELPAC student files for months. How the credential was stolen and whether MFA was required remain undisclosed.
→
COPC vishing stole credentials for PHI access
COPC’s 2026 vishing attack socially engineered credentials for internal access, exposing PHI for ~1.4M people. MyChart stayed up; MFA path stays undisclosed.
→
European bank VPN without MFA enabled months of recon
Unit 42 details how compromised credentials on a third-party bank VPN without MFA enabled months of scans, admin password guessing, and internal doc scraping.
→
Meta GitHub breach via stolen credentials
Meta says hackers used an employee’s stolen credentials to access GitHub repos, taking code and limited personal data for ~1,500 people. Internal systems untouched.
→
Dexcom vishing reached limited internal documents
Dexcom reported unauthorized access to limited internal-document information after targeted vishing. Products and operations stayed unaffected per the Oct. 10, 2026 statement.
→
ASOS trusted-contact scam stole employee logins
ASOS confirmed attackers impersonated a trusted contact, stole an employee login, then used those credentials on third-party platforms for data exposure and fake in-app alerts.
→
Hasbro vishing stole workforce login credentials
Hasbro’s March 2026 incident began with vishing that produced valid credentials, system file access, and a later employee account login built from compromise material.
→
iRhythm social engineering opened business apps
iRhythm confirmed social engineering access to third-party business apps in June 2026. At least 360,000 patients' data left; clinical systems stayed up.
→
TA419 AiTM kit targeted Microsoft 365 workforce sessions
TA419 proxied real Microsoft 365/Entra logins with Frameless BitB and Evilginx, built to capture passwords, MFA codes, and session cookies from US AI-policy workforce targets.
→
Astrana Health employee vishing via phone spoof
Astrana Health disclosed a material incident after attackers spoofed its main corporate number, vished employees, gained system access, and touched confidential server data.
→
EvilTokens device-code phishing stole M365 OAuth tokens
EvilTokens PhaaS tricked workforce users into real Microsoft device-login MFA, then took OAuth tokens for 12,000+ inboxes across 10,000+ orgs until the 2026 disruption.
→
How AiTM phishing steals MFA login sessions
AiTM kits relay the password and the MFA code or push as employees type them, then keep the session. Cloudflare, Reddit, Storm-1167, and Whisper 2FA.
↻ Updated Oct 2026
→
How password-only workforce portals still fall
Colonial's VPN, Change Healthcare's Citrix portal, PowerSchool's support portal: each breach began with a password on a path that never asked for MFA.
↻ Updated Oct 2026
→
How workforce vishing still steals MFA access
Callers still talk helpdesks into MFA resets or walk employees onto fake logins. Same class, years of victims, transferable factors every time.
↻ Updated Oct 2026
→
GhostCode stole OAuth tokens after real Microsoft MFA
GhostCode never stole a password. Victims finished real Microsoft MFA, then attackers collected OAuth tokens, registered devices, and harvested email within seconds.
→
M365 passkey helpdesk vishing stole cloud sessions
Passkey-themed IT helpdesk vishing steered Microsoft 365 users into AiTM and device-code paths, capturing post-MFA sessions for Graph recon and slow cloud theft.
→
Midnight Blizzard device-code phishing stole M365 tokens
GTG-20006 tricked staff into real Entra MFA on login.microsoftonline.com, then took OAuth tokens and bulk-exported Microsoft 365 mail from at least eight orgs.
→
AdaptHealth contractor SE exposed 4.1M patients
Social engineering compromised a privileged AdaptHealth contractor session. Attackers used identity-plane cloud access to expose about 4.1 million patients. No malware reported.
→
Aesto Health 9.5M breach has no public vector
Aesto Health’s disclosure wave cites over 9.5 million patients. Public reporting does not establish how attackers got in, what identity was abused, or any MFA path.
→
N0va kit: real MFA, stolen Microsoft tokens
N0va tricks workers into real Microsoft MFA on a device-code flow, then walks off with access and refresh tokens plus PRT-style device persistence. No password harvest required.
→
Passkey helpdesk vishing stole Entra M365 sessions
Microsoft tracked helpdesk callers since May 2026 who steered Entra users into passkey-themed AiTM and device-code flows, then stole sessions and enrolled attacker MFA.
→
BigBear 2.0 Evilginx2 stole M365 cookies after MFA
CloudSEK found BigBear 2.0's Evilginx2 PhaaS proxied live M365 logins, captured MFA, and exfiltrated 4,148 session cookies across 258 orgs.
→
Spring Ring Teams vishing never stole MFA codes
Unit 42’s Spring Ring used fake Teams IT helpdesks and 10 to 15 minute calls to push RMM or malware on 150+ staff. No passwords or MFA codes taken at login.
→
Mirage2FA AiTM stole M365 MFA and session cookies
Mirage2FA (LinXcoded) proxied Microsoft 365 logins, relayed live MFA, and stole session cookies. ANY.RUN tracked thousands of potential enterprise compromises.
→
DGFiP Breach: Usurped Agent and Third-Party Logins Exposed Tax Data on 678,000
ZeroBytes abused usurped DGFiP agent and third-party logins, claimed an MFA bypass, and pulled tax and cadastral data on 678,000 before access was cut.
↻ Updated Feb 2026
→
TheHatman Lists 3.64M Entra Employee Dumps; TCS Filing Names Password Spray and Push Fatigue
TheHatman advertised ~3.64M Azure/Entra employee records from nine firms. Only TCS’s filing names password spray and push MFA fatigue; TCS and Gap dispute a fresh breach.
→
AiTM stole a live Microsoft 365 session for BEC
One HR-themed click fed password and MFA through an AiTM proxy. Attackers replayed the Microsoft 365 cookie for ~30 days of cloud-only payment diversion.
→
Gunra Fortinet VPN and VDI OTP backdoor TTPs
Gunra affiliates combined Fortinet auth-bypass CVEs, VDI session-cookie theft, and a server-side OTP backdoor. CISA AA26-222A maps the workforce identity failures.
→
Five-week vishing harvested MFA codes at 200+ orgs
A five-week vishing campaign built phishing infrastructure against 200+ organizations, pushing employees onto spoofed logins that harvested passwords and MFA codes.
↻ Updated Sep 2026
→
Payroll Pirates: users finished MFA, sessions stolen
Voicemail lures proxied real Microsoft 365 login. Users finished MFA; attackers harvested session cookies and hunted payroll mail across hundreds of orgs.
↻ Updated Aug 2026
→
UNC6671 vishing stole hedge fund MFA sessions
UNC6671 spoofed helpdesk numbers, guided hedge fund staff to AiTM sites, and stole live MFA plus M365/Okta SSO sessions for multi-brand cloud extortion.
→
Greatness PhaaS stole MFA-approved Microsoft 365 tokens
Greatness PhaaS used RingCentral-spoofed AiTM and device-code lures to capture MFA-approved Microsoft 365 tokens, then replayed them across M365 apps for weeks.
→
IEH M365 mailbox phished via fake login page
IEH’s 8-K: one employee typed M365 credentials on a fake login page after a spoofed document-share lure. Single mailbox access, malicious rules, no confirmed exfil.
→
Weak email password opened Bank of Baroda file theft
TripleX claimed 700GB to 1TB from Bank of Baroda after one employee email password failed. The bank said core banking stayed untouched; mail files did not.
→
Okta payroll pirates helpdesk MFA re-enrollment
Okta tracked O-UNC-034 payroll pirates phoning helpdesks to reset passwords, re-enroll attacker MFA, then divert paychecks across multiple orgs.
→
Princeton OIT vishing won a Duo push approval
Princeton OIT: actor posed as Service Desk, fake login took a password, employee approved a Duo push. Advancement data hit midday Nov 10, 2025; stopped under 24h.
→
Whisper2FA AiTM harvested M365 MFA tokens
Barracuda tracked Whisper2FA since July 2025: AJAX live-relay AiTM stole Microsoft 365 passwords and MFA tokens at near-million monthly attack volume.
→
UNC6040 Salesforce vishing stole MFA codes
FBI/IC3 FLASH: UNC6040 vished Salesforce workforce users for credentials and MFA codes, then malicious Data Loader consent. Multiple orgs. Not Salesloft/Drift.
→
Workday HR-IT vishing accessed third-party CRM
Workday disclosed in August 2025 that HR/IT impostors texted and called employees for account access, then pulled business contacts from a third-party CRM.
→
Cisco CRM vishing exported basic profile data
Cisco says a July 2025 vishing call against a representative unlocked one third-party CRM instance and a subset of basic Cisco.com profile fields. No passwords.
→
Aflac social engineering opened network access
Aflac disclosed on 20 June 2025 that social engineering gave unauthorized network access. Disclosure does not name TAP, AiTM, or a threat actor.
→
Co-op helpdesk reset enabled member data theft
Co-op confirmed member data theft after April 2025 helpdesk password-reset social engineering. DragonForce affiliates claimed it; NTDS.dit theft followed the foothold.
→
M&S helpdesk password-reset social engineering
M&S was breached on 17 April 2025 via helpdesk password-reset social engineering. A third party reset an employee password; DragonForce-linked ransomware followed.
→
UK industrial AiTM phishing stole workforce sessions
JUMPSEC tracked AiTM reverse-proxy kits hitting UK industrial workforce logins via BEC PDFs, harvesting credentials and session tokens through March 2025.
→
Simmons Workday phishing and fraudulent MFA approval
A Simmons employee clicked a health-advisory phishing link, submitted credentials, approved a fraudulent MFA request, and attackers accessed Workday.
→
PowerSchool PowerSource no-MFA support login
Attackers signed into PowerSchool PowerSource with a no-MFA subcontractor password, then exported student and teacher SIS data via remote-support tools.
→
Okta Support impersonation sought MFA tokens
Okta's Dec 2024 advisory warns of Support-impersonation phishing seeking customer passwords and MFA tokens. Legitimate Support never asks for either.
→
Seyfarth Shaw helpdesk MFA phone-number swap
Seyfarth Service Desk staff replaced an employee's MFA phone after an impersonation call. Attackers then diverted ADP direct deposit for one payroll account.
→
Iranian M365 spray and MFA push bombing
CISA AA24-290A: Iranian actors sprayed M365/Azure/Citrix passwords, push-bombed MFA, then registered their own MFA devices for persistent workforce access.
→
TfL Scattered Spider helpdesk 2FA reset
Scattered Spider used marketplace TfL employee credentials plus helpdesk social engineering for a 2FA reset, then escalated privileges across workforce systems.
→
GuidePoint GRIT VPN vishing MFA harvest
GuidePoint GRIT tracked a 2024 US wave: helpdesk vishing, SMS fake Cisco/Fortinet/Palo Alto VPN pages, password plus OTP or push harvest at 130+ orgs.
→
Michigan Medicine employee approved unsolicited MFA
On July 30, 2024 a Michigan Medicine employee accepted an unsolicited MFA prompt. Attackers reached workforce email; about 57,891 patients later got notices.
→
Scattered Spider helpdesk MFA reset Okta SaaS attack
UNC3944 (Scattered Spider) used helpdesk calls with victim PII to reset passwords and MFA, then Okta SSO into SaaS for data theft, Mandiant said June 2024.
→
Michigan Medicine IT desk password-reset vishing
Between 23 and 29 May 2024, an attacker called Michigan Medicine's IT Service Desk, impersonated employees, and reset passwords on three workforce email accounts.
→
Cisco Duo supplier phish exposed SMS MFA logs
In April 2024 Cisco Duo said a phished telephony-supplier employee account led to download of SMS/VoIP MFA log metadata for about 1% of customers.
→
LA County DMH QR phishing took M365 mailbox
Around 20 March 2024 a LA County DMH employee scanned a phishing QR code and lost Microsoft 365 access. County notices cite an MFA weakness and mailbox-related PHI exposure.
→
Change Healthcare Citrix portal had no MFA
On 12 Feb 2024 criminals used a compromised employee password on a Change Healthcare Citrix portal with no MFA. Ransomware followed about nine days later.
→
Microsoft Midnight Blizzard password spray no MFA
Midnight Blizzard password-sprayed a Microsoft legacy test tenant account without MFA in late 2023, then reached a small set of corporate mailboxes.
→
Midnight Blizzard sprayed Microsoft no-MFA test tenant
Midnight Blizzard password-sprayed a Microsoft legacy no-MFA test tenant in late 2023, then accessed a very small share of corporate email accounts.
→
Scattered Spider helpdesk MFA reset TTPs
CISA/FBI AA23-320A: Scattered Spider posed as staff to reset passwords, transfer MFA, spam push prompts, SIM-swap phones, and coach OTPs at enterprise help desks.
→
Okta support breach: stolen service-account password
Okta support was accessed with a service-account password saved to a personal Google account. Files for 134 customers were taken; five sessions were hijacked via HAR tokens.
→
MGM 2023 cyberattack helpdesk MFA reset path
MGM’s Sept 2023 cyber incident is tied in public reporting to a Scattered Spider-style helpdesk call that reset workforce MFA factors before IdP access and outages.
→
Clorox Cognizant helpdesk password MFA resets
Clorox’s Aug 2023 8-K disclosed IT disruption. A later civil complaint alleges Cognizant Service Desk reset passwords and MFA for employee impersonators.
→
Okta helpdesk MFA resets unlocked Super Admins
Okta tracked helpdesk MFA factor resets on Super Admins from 29 July 2023, then inbound Org2Org federation used to impersonate workforce users across four US customers.
→
Storm-1167 AiTM stole M365 sessions and MFA
Storm-1167 used trusted-vendor Canva lures and fake Microsoft sign-ins to steal passwords, live MFA responses, and session cookies, then enrolled attacker OTP and ran BEC.
→
Henry Ford Health email phishing hit 3 mailboxes
Email phishing opened three Henry Ford Health employee mailboxes on 30 March 2023. PHI risk later covered ~168,215 patients. MFA details were never disclosed.
→
The Standard AiTM spear-phish stole email sessions
Spear phishing plus AiTM intercepted The Standard employee email sign-in sessions in April 2023 despite MFA, yielding intermittent mailbox access until 25 April.
→
Corteva ADP call-center DOB reset diverted payroll
In March 2023 a caller used a Corteva employee’s name and DOB at ADP’s payroll call center, reset the portal password, and diverted direct deposit for one worker.
→
Reddit employee phishing hit internal systems
In Feb 2023 a sophisticated phishing campaign obtained one Reddit employee’s credentials and reached limited internal docs, code, contacts, and advertiser data.
→
Mailchimp social engineering stole employee credentials
Mailchimp’s Jan 2023 notice: social engineering of staff and contractors compromised employee credentials, then a support tool reached 133 customer accounts.
→
Activision SMS phishing hit employee Slack
Activision confirmed Dec 2022 SMS phishing of an employee with reported Slack access. Company denies sensitive data loss; press disputes the impact scope.
→
CISA 2022 phishing-resistant MFA number matching
On 31 October 2022 CISA urged phishing-resistant MFA and number matching against push fatigue and phishable OTP. Technique archive, not a named-org breach.
→
Dropbox CircleCI phishing stole GitHub OTPs
In October 2022 CircleCI-themed phishing harvested Dropbox employee GitHub passwords and hardware OTPs. Attackers then copied about 130 private repositories.
→
Uber contractor MFA fatigue opened internal tools
Uber’s 2022 breach started when a contractor’s corporate password met MFA fatigue: repeated 2FA push approvals until one was accepted, then internal Slack and G-Suite access.
→
Twilio 0ktapus smishing harvested employee OTPs
Mid-July 2022 0ktapus smishing sent Twilio staff to fake Okta pages, harvested passwords and OTP codes live, then hit admin tools. Impact: 209 customers, 93 Authy users.
→
Cloudflare SMS AiTM Okta phish stopped by FIDO2
July 2022 SMS AiTM phishing hit Cloudflare Okta. Three staff entered passwords; mandatory FIDO2 keys blocked takeover. No systems were compromised.
→
Twilio employee vishing stole credentials
On 29 June 2022 a Twilio employee was vished into handing over credentials. Attackers briefly reached limited customer contact data before access was cut in about 12 hours.
→
Cisco MFA fatigue vishing opened VPN access
Cisco learned of a 2022 VPN compromise after browser-synced credentials, MFA push fatigue, and multi-day vishing got push acceptance, then attacker MFA enrollment.
→
Mailchimp social engineering stole employee credentials
In March 2022, social engineering of Mailchimp employees compromised credentials and opened an internal support tool. 319 accounts viewed; data exported from 102.
→
Lapsus$ hit one Microsoft employee account
In March 2022 Lapsus$ (DEV-0537) compromised one Microsoft employee account with limited DevOps access. No customer code or data. Group TTPs, not a proven org MFA verdict.
→
NVIDIA Lapsus$ stole employee passwords, NTLM hashes
In February 2022 Lapsus$ hit NVIDIA IT. Employee passwords and proprietary data were taken; ~71,335 NTLM hashes later circulated. Initial access stays unspecified.
→
Lapsus$ RDPed Okta Sitel support engineer PC
In January 2022 Lapsus$ RDPed a Sitel support engineer already logged into Okta apps. Okta found ~25 minutes of control, two tenants touched, no direct customer ATO.
→
Healthplex O365 phishing, MFA off on OWA
Healthplex learned on 24 Nov 2021 a fake fax lure stole an employee password. MFA was off on Outlook Web Access after O365 migration, so the mailbox opened.
→
Robinhood support employee phone vishing breach
Late on 3 Nov 2021 phone social engineering of a Robinhood support employee opened customer support systems. ~5M emails and ~2M names followed; no SSNs or customer money loss.
→
University Duo OTP phishing harvested SMS codes
Proofpoint tracked COVID/Omicron phishing that spoofed university and Duo pages, stole passwords plus SMS OTPs, and reused campus mailboxes against peer schools.
→
Weill Cornell employee email phishing exposed PHI
Weill Cornell found unauthorized employee mailbox access Sept 9-23, 2021 via phishing. Residual PHI sat in email; EMR untouched. Mechanics stay unspecified.
→
Luminis Health employee email phishing breach
In 2021 an intruder accessed limited Luminis Health employee email accounts via phishing-linked compromise. About 824,450 people were notified over mailbox data.
→
Mon Health phishing email takeover enabled BEC
Mon Health found phishing had taken contractor and employee mailboxes for months. A vendor missed-payment tip exposed BEC and wire-fraud attempts tied to ~398,000 patients.
→
EA helpdesk MFA tokens after Slack cookie foothold
Attackers bought EA Slack cookies for about $10, messaged IT with a lost-phone story, got MFA tokens twice, then claimed ~780 GB of game source and tools.
→
Colonial Pipeline DarkSide legacy VPN no MFA
DarkSide entered Colonial on 29 April 2021 via a legacy employee VPN password with no MFA. Ransomware hit 7 May; about 100 GB was reportedly taken.
→
CHKD employee email phishing exposed patient PHI
On 20 April 2021, phishing compromised a limited number of CHKD employee email accounts and exposed patient-related PHI. Public notices omit MFA detail.
→
UC San Diego Health employee email phishing
UC San Diego Health reported phishing-driven unauthorized employee email access from Dec 2020 to Apr 2021, with ~495,949 people potentially exposed via mailboxes.
→
Oldsmar SCADA: shared remote password, no 2FA
On 5 Feb 2021 unauthorized remote access hit Oldsmar water SCADA. Reporting cites a shared remote password and no 2FA; lye dosing rose until an operator fixed it.
→
WMed phishing took one employee mailbox
WMed reported a Jan 2021 phishing click that opened one employee mailbox. About 2,474 people were notified after SSNs and other workforce data were exposed.
→