How Credential Exposure Can Undermine Legacy MFA
Summary
Sponsored analysis uses a reported Figure exposure of nearly 967,200 email records to explain credential stuffing, targeted phishing, help-desk social engineering and real-time phishing relays, then promotes Token’s biometric, hardware-bound authentication.
Key points
- The article cites TechRepublic’s report that Figure exposed nearly 967,200 email records in a breach disclosed in February 2026.
- It explains how exposed email addresses may be used in credential stuffing, targeted phishing and help-desk social engineering.
- In an adversary-in-the-middle phishing relay, a proxy forwards credentials and MFA challenges between a victim and a legitimate service, potentially giving the attacker an authenticated session.
- The article says push notifications, SMS codes and TOTP can be vulnerable to real-time relays, while repeated push prompts can enable MFA fatigue attacks.
- It presents origin-bound cryptographic credentials, hardware-bound keys and live biometric verification as properties of phishing-resistant authentication.
- Token claims its platform combines hardware-bound authentication, fingerprint verification and Bluetooth proximity; these are vendor claims in sponsored content.
Article Details
- Topic
- Credential exposure and legacy MFA weaknesses in phishing-relay and account-takeover attacks
MITRE ATT&CK
T1078 · Valid AccountsDescribes adversaries using valid credentials to log in as users and obtain authenticated sessions.T1110.004 · Credential StuffingDescribes credential stuffing using exposed email addresses and passwords from prior breaches against enterprise portals and identity providers.T1557 · Adversary-in-the-MiddleDescribes a real-time phishing relay in which a reverse proxy forwards credentials and MFA responses between a victim and a legitimate service.T1566 · PhishingDescribes targeted phishing messages impersonating internal communications and tailored to recipients.T1621 · Multi-Factor Authentication Request GenerationDescribes repeatedly triggering push notifications to pressure users into approving an MFA request.
Vendors
Products
Tools
EvilginxToolkits that automate this attack — Evilginx, Modlishka, Muraena, and their derivatives — are publicly available, actively maintained, and require no advanced tradecraft to operate.ModlishkaToolkits that automate this attack — Evilginx, Modlishka, Muraena, and their derivatives — are publicly available, actively maintained, and require no advanced tradecraft to operate.MuraenaToolkits that automate this attack — Evilginx, Modlishka, Muraena, and their derivatives — are publicly available, actively maintained, and require no advanced tradecraft to operate.
Industries
Critical infrastructurefailure is not an acceptable outcome — defense contractors, financial institutions, critical infrastructure, and enterprise environments with high-privilege access requirements.DefenseFor on-call administrators, trading floor operators, and defense contractors working across multiple workstations, this eliminates the friction that drives the shadow IT and workaround behavior legacy hardware tokensFinancial ServicesIn February 2026, TechRepublic reported that Figure, a financial services company, exposed nearly 967,200 email records in a newly disclosed data breach.