How to steal credentials and bypass MFA 2.0 (yes, it got worse)

Remember last year when I showed you how attackers steal credentials and bypass MFA? Good times. Well, the attackers have been busy, and honestly, they've made my job depressingly easy.

MFA bypass is now table stakes. You can buy a complete Phishing-as-a-Service kit for $120 a month -- with helpdesk support, Telegram integration, and probably a better onboarding experience than most of your SaaS vendors. Infostealers harvested 1.8 billion credentials from 5.8 million devices last year alone. That's an 800% increase. And just when you thought passkeys would save us, along come ClickFix and ConsentFix to ruin that party too.

In this sequel nobody asked for (but everybody needs), I'll walk through the new attack playbook: device code phishing that went from Russian intelligence technique to commodity kit in 12 months, the infostealer economy where your credentials sell for less than a flat white, and browser-native attacks that bypass everything including passkeys. I'll share a real incident from an Australian organisation where one stolen session token -- not a password, not an MFA code, a session token -- led to multi-tenant compromise over 28 days. Twenty-eight days. Nobody noticed.

You'll walk away with a tiered defence framework you can actually implement. Or at the very least, some fresh nightmare fuel for your next board presentation.

Warning: May contain existential dread. Side effects from last year's session have not subsided.