Researchers Crack Microsoft Azure MFA in an Hour

Oasis Security disclosed "AuthQuake", a Microsoft Azure MFA bypass that allowed attackers to rapidly create sessions and enumerate 6‑digit TOTP codes because of absent rate limits and an extended code tolerance window; researchers showed an attacker could reach ~50% success after about 24 sessions (~70 minutes). Microsoft patched the flaw after disclosure; recommended mitigations include strict rate limiting, shorter TOTP tolerance, MFA failure alerts, and use of authenticator apps or strong passwordless methods.