Identity breach teardowns

A campaign against Snowflake customer tenants showed what happens when stolen credentials meet accounts without MFA: dozens of breaches, no platform vulnerability required.

Infostealer malware has made stolen session cookies a primary attack path, letting attackers ride an authenticated session and skip both the password and MFA entirely.

How a Russia-linked group reached Microsoft corporate email by password-spraying a forgotten test tenant and abusing OAuth application permissions, a lesson in legacy accounts and consent risk.

How attackers used a stolen credential to read Okta support cases and harvest session tokens, why HAR files were the weak link, and what it taught the industry about protecting the identity provider itself.

Scattered Spider showed that the fastest way past strong authentication is often a phone call to the help desk. Here is the pattern and how to close it.

Push-based MFA can be defeated not by breaking the cryptography but by wearing the user down. Here is how MFA-fatigue attacks work and why number matching and phishing-resistant methods matter.