Lapsus$ gained entry to Microsoft, Samsung, and Ubisoft by using passwords that had already been stolen from earlier leaks or direct theft. The attackers simply supplied those credentials at the login page and received valid sessions. No second factor was ever challenged because the passwords themselves were already in hand.
How Stolen Passwords Produced Reusable Session Tokens
Once the first login succeeded, the attackers received session cookies and SAML assertions from the identity providers. Those tokens let them reach internal tools, source code, and customer data without entering any further credentials or codes. The same sequence played out at each of the three companies: one compromised password produced tokens that worked across federated services.
According to Microsoft’s disclosure, Lapsus$ used stolen employee credentials to reach accounts and then moved laterally using existing permissions. Samsung and Ubisoft described comparable access after credential theft. In every case the second phase required no additional authentication because the initial login had already issued reusable tokens.
How Federation Expanded One Login Into Broad Access
Lapsus$ relied on the SAML assertions issued after the first successful authentication. Because each organization used federation to connect multiple applications, a single valid assertion unlocked many systems without new logins. The blast radius came from the SSO layer itself, not from any weakness in the second factor.
Stolen tokens cannot be stopped by passwords, OTPs, or push approvals because authentication has already finished. Defenses that remain effective are short token lifetimes, strict origin binding, and signatures that must be generated fresh by hardware the attacker does not control.
The same credential-to-token pattern appeared in other Lapsus$ operations against technology companies during the same period. Each time the initial theft of passwords created the foothold; everything afterward ran on stolen sessions.
Device-bound credentials close the initial gap because the private key never leaves the enrolled hardware and every signature is bound to the exact service origin. The device-bound architecture shows how that boundary is enforced across the request lifecycle.
The full technical breakdown of what actually works is at mfa2point0.com.
FAQ
How did Lapsus$ obtain the initial credentials at Microsoft, Samsung, and Ubisoft?
Lapsus$ obtained the credentials through prior leaks and direct theft rather than live phishing during the incidents. The attackers then used those passwords to authenticate directly, producing session tokens they could reuse without further interaction with any second-factor system.
Would an OTP or push notification have stopped the Lapsus$ access?
Yes. It would have prevented access because in addition to a password an OTP or Push was needed. However, OTPs and Push notifications can be interpreted. And finally, once a legitimate authentication happened, the resulting session token allowed movement without additional challenges.
What allowed Lapsus$ to reach multiple internal systems after the first login?
Federation tokens such as SAML assertions issued after the initial credential use granted access across connected services. These tokens required no new authentication, which is why one compromised account produced broad access inside each organization.
Could helpdesk social engineering have been limited in these Lapsus$ cases?
Yes. Re-enrollment of attacker devices relied on support staff being convinced to reset or add factors. Stronger identity assurance processes that do not involve helpdesk staff would have removed that path entirely.
Why did the same group succeed against several large technology companies in quick succession?
Each target relied on password-based login. The pattern of stolen credentials followed by token reuse repeated because the underlying authentication model stayed the same across organizations.
