https://calebgarber.com/tags/mfa/ Recent content in MFA on Caleb Garber Hugo -- 0.165.0 en-us Tue, 22 Sep 2026 00:00:00 +0000 https://calebgarber.com/posts/the-akira-mfa-bypass-campaign-on-sonicwall-ssl-vpns-says-about-otp-mfa-at-the-edge-of-a-higher-ed-network/ Tue, 22 Sep 2026 00:00:00 +0000 https://calebgarber.com/posts/the-akira-mfa-bypass-campaign-on-sonicwall-ssl-vpns-says-about-otp-mfa-at-the-edge-of-a-higher-ed-network/ What the Akira campaign against SonicWall SSL VPNs reveals about TOTP MFA, stolen credential sets, and what to check at the VPN edge. https://calebgarber.com/posts/bigbear-2-0-aitm-phishing-mfa-bypass/ Sun, 13 Sep 2026 00:00:00 +0000 https://calebgarber.com/posts/bigbear-2-0-aitm-phishing-mfa-bypass/ BigBear 2.0 is an Evilginx2-based phishing-as-a-service that captured finished Microsoft 365 sessions after victims completed MFA, compromising 258 organizations. I break down the offy phishlet, the infrastructure, and the controls that hold. https://calebgarber.com/posts/what-the-kali365-device-code-phishing-wave-means-for-our-mfa-posture-blocking-oauth-device-code-flow-with-conditional-access/ Sat, 12 Sep 2026 16:14:00 -0500 https://calebgarber.com/posts/what-the-kali365-device-code-phishing-wave-means-for-our-mfa-posture-blocking-oauth-device-code-flow-with-conditional-access/ A Telegram-distributed phishing kit is bypassing MFA on Microsoft 365 with the OAuth device code flow. Here is how I detect and block it.