One criminal, 50 hacked organizations, and all because MFA wasn't turned on

Zestix (also known as Sentap) is operating an active infostealer campaign that harvests credentials from infected endpoints (using malware such as RedLine, Lumma, and Vidar) to log into enterprise file synchronization and sharing platforms lacking enforced MFA, exfiltrate sensitive corporate and infrastructure data from around 50 organizations (including engineering, health, aviation, and defense-related files), and sell the stolen datasets on the dark web; the report emphasizes credential hygiene and enforcing MFA as primary mitigations.