Live MFA Relay Is Now Routine: What Credential-Free Changes

Week of 12 October 2026 | Compiled by Team Paringa

Phishing kits are now operated in real time, relaying passwords and one-time codes as victims type them. Meanwhile stolen credentials are fuelling ransomware at scale.

What Happened This Week

🔴 Browser-in-the-browser kit relays MFA codes in real time

Island researchers Oleg Zaytsev and Ofek Ronen detailed a phishing operation impersonating AI brands (Gemini, Claude, ChatGPT, Perplexity and Manus) with advertising lures. A fake Meta Muse Ads site, museads.ai, appeared by 17 September, nine days after Meta announced its Muse AI agent. Victims include agency staff, media buyers and ad account administrators, and the goal is account access, stored payment methods and linked client accounts.

The technique is browser-in-the-browser. A "connect" button opens a fake browser window inside the real one, with a convincing address bar showing accounts.google.com or an Okta tenant. The real browser stays on the phishing domain, so what the victim types goes to the attacker. A human operator watches each submission live and chooses the next prompt: a second password, an SMS or Okta authenticator code, a Google approval code, an Okta push request or a QR code. The kit supports Google, Meta, TikTok and Okta workflows.

Scale is meaningful. One frontend alone logged submissions from about 200 distinct email addresses over roughly a month, and Island says total volume is substantially higher. The campaign is still active, and the operators have not been identified. The platform runs on a common Next.js and Socket.IO stack, with Vercel frontends and Railway or Render back ends.

Sources: The Register

Look at what the attacker is relaying: passwords, SMS codes, authenticator codes, push approvals. Every one of those is something the user holds and can be talked into handing over, which is why a live operator beats them. Push and OTP flows from Okta or Microsoft Entra are in scope for this kit, so do not assume your current MFA posture covers you. Audit which of your user populations still depend on codes or approvals, and prioritise a move to credential-free authentication where there is nothing issued to the user to type, approve or lose.

🔴 FortiBleed shows what happens when credentials are the weak link

A 6 October FBI and US Secret Service advisory says criminals using FortiBleed-linked credentials are locking organisations out of Fortinet firewalls. SOCRadar has verified more than 86,644 compromised devices across 194 countries. Attackers use credentials from earlier breaches and infostealer logs for stuffing and spraying, and crack extracted password hashes offline on GPU clusters. Initial access brokers resell the access, and evidence points to INC/Lynx and Payload ransomware affiliates. SOCRadar said in July it had seen at least 12 confirmed ransomware attacks from the campaign.

The agencies' guidance includes resetting passwords and enabling phishing-resistant MFA. That is sensible, but note the dependency: the whole campaign exists because a reusable secret was stolen once and sold repeatedly.

Sources: The Register, Industrial Cyber

The advisory tells you to harden the login. Ask the harder question: why is there a reusable credential to steal at all? Phishing-resistant methods such as FIDO2 raise the cost of the login step, but attackers that sit in the middle can still steal the session token afterwards and walk in. Where you can, remove the issued credential from the design and treat session theft as part of the same threat model.

🟡 Typosquatting and lookalike domains get cheaper

The Register reported on 10 October that two look-alike characters, mixing Cyrillic and Latin letters, open up fresh typosquatting opportunities in Chromium browsers, letting attackers imitate popular sites. Island's advice on the BitB campaign applies here too: check the real address bar, keep a baseline of trusted domains, and expect convincing fakes to be quick and cheap to build.

Sources: The Register

User vigilance is a weak control against pixel-perfect lookalikes. Authentication that does not depend on the user judging whether a page is genuine removes that burden, and that is the commercial case worth making to security leaders this quarter.

What Identity Teams Are Dealing With

Identity teams are fielding phishing that is operated like a call centre. Kits now adapt per victim, ask for whichever factor works and relay it immediately, so the old distinction between "MFA on" and "MFA off" tells you little. The more useful questions are which factors remain phishable, how long a stolen session stays valid, and how fast you can revoke it.

Budget conversations are shifting too. After advisories like the FBI's, boards ask whether staff can still be tricked into handing over access, and "we have MFA" is no longer a convincing answer. Expect scrutiny of push approvals and one-time codes first.

Three Things Worth Watching Next Week

1. Spread of the BitB kit — Island says the campaign is still active and adds new brand lures. Watch for further reporting on additional identity providers being targeted.

2. FortiBleed follow-ups — More ransomware victim disclosures and updated FBI indicators are likely. Watch whether guidance on session and token revocation gets sharper.

3. Regulator and insurer questions on MFA — Expect more questions about which factors are phishable in renewals and audits. Have your answer ready by user population.

Questions? hello@paringa.ai

Paringa helps channel partners and their customers move from phishable factors toward credential-free authentication. We focus on what attackers can steal today, and what can be removed from the equation. | 12 October 2026 | © Paringa Ltd