Europol just took down Tycoon 2FA — the biggest phishing-as-a-service platform (96K victims, 55K Microsoft accounts). Meanwhile, Starkiller shows AitM phishing is now a SaaS product. TOTP, push, and SMS MFA all fail. Only FIDO2 passkeys stop it.

https://iamdevbox.com/posts/aitm-phishing-starkiller-tycoon-2fa-mfa-bypass-defense/?utm_source=mastodon&utm_medium=social&utm_campaign=blog_post

#Phishing #MFA #Passkeys #FIDO2 #IdentitySecurity