Plan
active
N0va Phishkit Targets US/EU Businesses via Auth Flow Abuse
- Engineer — Plan: AiTM-style phishing that bypasses MFA by hijacking legitimate auth flows warrants reviewing phishing-resistant MFA (FIDO2/passkeys) and conditional access policies; audit identity provider logs for anomalous session tokens this quarter.
- SOC/IR — Plan: No IOCs are provided, but the technique — abusing legitimate auth flows to harvest session tokens — is worth building detections for: tune SIEM rules to flag impossible-travel logins and anomalous OAuth token grants from new IP ranges.
- Leader — Learn: Broad US/EU targeting of businesses via identity compromise is a useful data point for risk discussions around MFA strength, but no named victims or sector-specific details make this a board-level action item yet.
This entry was curated and judged by AI (Claude) with automated enrichment
(CISA KEV / EPSS / public PoC). Verify against the original source before
acting. Found a bad verdict?
Report it —
confirmed errors go to the corrections log.