How MFA Raises the Barrier to Account Takeover for Small Businesses
Summary
The article explains how MFA blocks simple password attacks but not session-token theft, and describes how attackers obtain tokens through AiTM phishing or credential-stealing malware. Huntress says its SOC detects about 2,000 suspected credential attacks weekly.
Key points
- Without MFA, attackers can use brute forcing, password spraying, or stolen credentials to access accounts through standard authentication.
- Huntress reports about 2,000 suspected credential attacks detected by its SOC each week, based on anomalous login locations or VPNs for identities without MFA.
- The article describes a New Zealand IT service company whose suspicious login from a U.S. IP address was stopped by the SOC before account takeover.
- MFA makes password-based access harder, but attackers may steal and replay session tokens that let users access services without repeating authentication.
- Active token theft can use adversary-in-the-middle phishing proxies; passive theft can use tokens obtained from dumps or stolen by credential-stealing malware.
- The article says credential stealers may be delivered through malvertising or SEO poisoning, and recommends endpoint hardening to reduce their delivery and execution.
- The author concludes that any MFA is better than none, while acknowledging that some users may lack the technology or computer literacy to use it.
Article Details
- Topic
- How multi-factor authentication affects account takeover risks for small and medium businesses, including password attacks and session-token theft.
MITRE ATT&CK
T1110 · Brute ForceThe article describes brute forcing and password spraying against identities without MFA.T1189 · Drive-by CompromiseIt describes credential stealers distributed through malvertising, leading users to execute trojanized applications.T1539 · Steal Web Session CookieIt describes stealing session tokens and reusing them to authenticate.T1555 · Credentials from Password StoresIt describes credential-stealer malware scraping credentials from a victim's browser and file system.T1557.003 · DHCP SpoofingIt describes adversary-in-the-middle attacks using a transparent proxy to broker authentication.
People
Malware
Products
Tools
Evilginxauthenticating to a transparent proxy which brokers authentication to the real Microsoft 365 service. Evilginx is the most well known of these AiTM toolkits, but many Phishing-as-a-Service kits like NakedPages andEvilProxyis the most well known of these AiTM toolkits, but many Phishing-as-a-Service kits like NakedPages and Evilproxy perform similar attacks every day against the SMB.NakedPagesEvilginx is the most well known of these AiTM toolkits, but many Phishing-as-a-Service kits like NakedPages and Evilproxy perform similar attacks every day against the SMB.
Countries
New ZealandOne example of credential theft included a small IT service company based in New Zealand that was observed logging into their identity from a United States IP address. The event of interest also indicated that the loginUnited Statesa small IT service company based in New Zealand that was observed logging into their identity from a United States IP address. The event of interest also indicated that the login was using an operating system that had