Fire in the Cisco! Networking giant's Duo MFA message logs stolen in phish attack

Cisco warned that a Duo telephony subcontractor suffered a phishing-driven credential compromise on April 1 that allowed attackers to download SMS message logs (phone numbers, countries/states, timestamps, carriers) for messages sent in March 2024, though message content was not accessed. Separately, Cisco Talos is tracking a global, TOR-sourced increase in brute-force/password-spray activity since mid-March targeting VPNs, web authentication interfaces, and SSH across multiple vendors; Cisco advises logging, hardening default VPN profiles, and blocking malicious sources.