The Betterment breach should not have surprised anyone paying attention, and it certainly should have ended the long-running argument about whether modern MFA is sufficient against today’s attacks. Instead, it became just another entry in a growing list of incidents that organizations explain away as bad luck, poor training, or unfortunate human error.

Passwords are the single most exploited element in enterprise security. Attackers do not need to break through perimeter defences. They obtain a valid credential and log in. Breach investigation reports confirm this year after year. Stolen or weak passwords are the starting point for the majority of enterprise incidents.

Most organizations still think of authentication as a cost of doing business.

Device-based biometrics are the Only Way to Restore It.

How a Phishing Relay Attack Works Phishing relay attacks do not break authentication. They sit in the middle of it. A phishing relay attack inserts an attacker-controlled proxy between the victim and the legitimate login portal. The victim believes they are on the real site. Every credential they enter goes to the attacker first. The sequence is predictable. The victim receives a phishing email linking to a page that looks identical to the real login portal. They enter their username and password. The attacker’s proxy forwards these to the real site immediately. The real site triggers an MFA challenge. The proxy mirrors that challenge back to the victim. The victim enters their six-digit code or approves a push notification. The attacker forwards the response. The real site authenticates the session. The exchange takes seconds. The victim has logged in. The attacker has the session.

Another Preventable Breach Another week. Another preventable breach. This time it is DoorDash, confirming that a social engineering scam gave attackers access to sensitive customer and driver information. But the real story is not the scam. The real story is the failure behind it.

What do CISA, NSA, NIST, OMB, DHS, the Department of Defense, Gartner, Microsoft, Google, the FIDO Alliance, and the entire cyber insurance industry know that so many organizations are still ignoring?

As seen in Bleeping Computer The Tycoon 2FA phishing kit signals a turning point in the battle against account takeover. This is not a tool built for elite attackers. It is a plug-and-play phishing kit that anyone can deploy, with zero coding skills required. Tycoon automates everything: setup, fake login pages, reverse proxy servers, real-time credential capture, and full MFA relay.

Ransomware does not start with ransomware. It starts with access. An attacker who can log in as a legitimate user can move quietly through the network, escalate their privileges and deploy a payload before anyone notices. Most ransomware defences focus on the payload stage. The attackers win before that stage is even reached. The ransomware kill chain is a framework for understanding how attacks progress from first contact to full compromise. Breaking it requires understanding where in the chain authentication failures occur and what it would take to close them.

A newly published academic paper introduces a new hacker tool called PixSnapping (download PDF), an advanced attack that can steal screen pixels from Android devices and reconstruct sensitive data like 2FA codes in real time. The research demonstrates that an attacker-controlled app can capture or infer the digits displayed by authenticator apps such as Google Authenticator in under thirty seconds.

A study from UC San Diego Health ran nearly 20,000 employees through ten simulated phishing campaigns over eight months. Training made almost no difference. Employees who had recently completed mandatory cyber awareness courses failed phishing tests at virtually the same rate as those who had not. The measured improvement was just 1.7%. More than 75% of employees spent less than a minute on the training material. Millions are spent on annual training. The phishing success rate stays the same. The lesson is clear. Training alone does not protect enterprises from phishing.

Microsoft Active Directory Federation Services is one of the most widely deployed authentication systems in enterprise IT. Organisations use it to provide single sign-on across internal and external applications, often as a bridge between on-premises Active Directory and cloud services. It is also structurally vulnerable to a class of attack that legacy MFA cannot stop.