Phishing-resistant MFA is holding. The account is still being taken over.

Phishing-resistant MFA is holding. The account is still being taken over.

Week of 7 September 2026 | Compiled by Team Paringa

The cryptography is not failing. Enrollment, recovery, session issuance and federation are, and every one of them sits outside the part of the login your MFA vendor measures.

What Happened This Week

🔴 39 documented ways to compromise a passkey-protected account without touching FIDO2

Security researchers have now published at least 39 distinct attack paths against passkeys and the infrastructure around them, catalogued in a 4 September analysis. Many have working proof-of-concept tooling. The point that matters for anyone who has just finished a passkey rollout: FIDO2 cryptography can remain completely intact while the account it protects is taken over.

SpecterOps demonstrated the cleanest version in its Pass the Passkey research. Malware does not need to extract a private key. A malicious Windows application asks the legitimate WebAuthn infrastructure to generate a signed assertion, the user sees what looks like a normal Windows authentication prompt, completes verification, and the attacker receives the assertion. The key never left its protected store. SpecterOps also built tooling that repeatedly invokes legitimate-looking Windows passkey prompts, recreating the push-fatigue problem the industry supposedly solved, plus techniques that make malicious authentication appear to originate from an application the employee already trusts.

The second cluster is architectural. Once a credential can be synced, exported, restored or moved between devices, the security boundary expands to the phone, the OS, the password manager, the cloud account, the browser extension ecosystem and the recovery process. Published techniques include synced vault compromise, Apple and Google account takeover, cloud recovery takeover, KeePassXC and Bitwarden export theft, malicious browser extensions and CTAP and Bluetooth transport attacks.

The third cluster is the most operationally relevant: attackers do not steal the passkey, they create a new one. Shadow passkeys, enrollment vishing, attacker phone enrollment, help desk takeover, temporary credential abuse, SIM-based recovery and migration pretext attacks all end with the legitimate service issuing a perfectly valid credential to the adversary. Nothing was cracked. The identity system did exactly what it was designed to do.

Sources: BleepingComputer, SpecterOps

This is the argument identity teams have been avoiding. Rolling out phishing-resistant MFA across Entra ID or Okta hardens the authentication ceremony and leaves enrollment, recovery, help desk and sync completely exposed, and those are where the incidents now happen. Ask your provider one question: what stops an attacker registering an additional authenticator on an account they have partial control of. If the answer involves a help desk process or an email loop, you have bought protocol strength and inherited process weakness. The structural fix is architectural rather than procedural, because credential-free authentication removes the object that gets phished, replayed, synced, exported or fraudulently enrolled in the first place. You cannot steal a credential that was never issued.

🟡 5,000 Dropbox accounts accessed with no password, via a trusted identity provider

Dropbox began notifying users on 2 September that an unauthorised party accessed accounts by exploiting a flaw in Lenovo's email verification process. Dropbox uses Lenovo Identity Provider Services as part of its authentication infrastructure. The attacker registered a Lenovo ID against a victim's email address, then used that ID to log into the Dropbox account on the same address. No password required.

Many affected users had never created a Lenovo account. One reported that the Dropbox login page had started offering "Continue with SSO" for an email address with no Lenovo ID behind it. Dropbox's identity-linking process trusted Lenovo's assertion that the attacker controlled the email address, without requiring confirmation through the existing Dropbox login. Access ran from 4 to 21 August. Reuters reported approximately 5,000 accounts accessed, with content viewed and downloaded from some.

The remediation is instructive: Dropbox expired all sessions authenticated through Lenovo IDs and now requires the Dropbox account password before Lenovo ID authentication will complete. Lenovo described it as a legacy integration issue and said its own customers were not affected.

Sources: BleepingComputer, Reuters

Every federation you accept is an authentication decision you have outsourced to someone else's email verification logic. Neither MFA strength nor password hygiene was relevant here, because the login never went through either. Two actions worth taking this month: inventory every external IdP your tenant will accept an assertion from, including legacy consumer integrations nobody has reviewed since procurement, and confirm that identity linking requires proof from an existing authenticated session rather than mere control of an email address. The three-week detection gap is the other tell. Session-based access from a legitimate IdP produces no failed logins and no anomalous MFA events, so there is nothing for a SOC to alert on.

🟡 Invisible Unicode is getting phishing lures past mail filters at volume

Microsoft is warning of a high-volume phishing campaign that hides lure content using invisible Unicode tag characters. Attackers insert the characters inside financial keywords, splitting the words so that filters parsing the message body never see the terms they are tuned to catch. The recipient's mail client renders the text normally. The filter reads something that does not match any rule.

This lands on top of a phishing-as-a-service market that has industrialised MFA bypass. Adversary-in-the-middle kits with MFA downgrade functionality are commodity items, and downgrade remains the standard route around phishing-resistant enrolment, pushing the victim onto a weaker fallback method the tenant still permits. New kits keep appearing, with Jalisco and OmegaLord both observed targeting Microsoft 365 accounts using techniques that defeat multi-factor authentication.

The pattern across all three is delivery evasion feeding a credential-capture proxy. The lure gets through because the filter cannot read it, the proxy harvests the session because the user completed a legitimate MFA challenge on a page they believed was real, and the resulting token is a bearer credential that works from anywhere until it expires.

Sources: BleepingComputer

Filter evasion is a losing arms race and every hour spent tuning content rules is an hour not spent on the actual failure point, which is that a successful phish still yields a working session. The control that matters is what happens after the user clicks. Check whether your tenant permits fallback to a weaker MFA method when the strong one is unavailable, because that setting is what makes downgrade kits profitable, and it is enabled by default in more environments than most identity leads assume. The strategic version of the same point: if there is no credential and no reusable session token to capture, the proxy in the middle has nothing to relay.

What Identity and Security Leaders Are Dealing With

The industry sold phishing-resistant MFA as an end state. This week's evidence says it is a hardened front door on a building with a shared loading bay. Three separate stories, three separate bypasses, none of which involved defeating a cryptographic protocol: an assertion generated by legitimate Windows infrastructure at an attacker's request, a federated identity provider vouching for an email address it never verified, and a filter that could not read the words in front of it.

The common thread is that authentication strength is measured at one moment and account control is exercised across many. Enrollment, recovery, device registration, help desk verification, federation trust and session lifetime are all part of the identity system and none of them are covered by the phrase "we deployed FIDO2." The organisations getting this right are applying the same assurance standard to adding an authenticator as they do to using one, and are increasingly asking a harder question: why issue a shareable, syncable, enrollable credential at all when the whole attack surface described above only exists because one was issued.

Three Things Worth Watching Next Week

1. Passkey enrollment guidance from the major IdPs - With 39 published attack paths and enrollment as the weakest link, expect vendor guidance on requiring an existing authenticator to register a new one. Watch whether it ships as a default or an option.

2. More federated identity-linking failures - The Dropbox and Lenovo case will prompt other providers to audit legacy IdP integrations. Assume more disclosures, and assume some organisations discover trust relationships they did not know existed.

3. AiTM kit consolidation - Jalisco, OmegaLord and Bluekit are all iterating fast, with browser-in-the-middle capability now standard. Watch for the first kit that automates fraudulent authenticator enrollment as a post-compromise step rather than just session theft.

Questions? hello@paringa.ai

Paringa works with organisations whose identity programme has hit the limits of what MFA can do. If the answer to "how do we stop credential theft" keeps arriving as another factor, we should talk. | 7 September 2026 | © Paringa Ltd