Pushing Your Way In

The report outlines how attackers increasingly exploit stolen credentials through password spraying and bypass multi-factor authentication using reverse-proxy toolkits (CredSniper, Modlishka, Evilginx2) and push-notification fatigue. It highlights that some services validate credentials before enforcing the second factor, enabling credential verification and identification of accounts lacking MFA, and recommends user training to recognize indicators such as unsolicited phone verifications, unexpected push prompts, and new device/location sign-ins.