Executive briefing on identity attacks that bypass traditional security controls
Category Overview
This category focuses on executive-level storylines involving credential theft, MFA bypass, and token/session compromise — the identity attacks most commonly used by ransomware operators, hybrid intrusion groups, and cloud-native adversaries.
Executives often assume MFA prevents account takeover. These storylines demonstrate why that assumption is dangerously false in modern cloud environments.
Modern Cloud Intrusions Rely On
Bypassing MFA entirely through sophisticated techniques
Stealing session cookies from compromised endpoints
Replaying refresh tokens to maintain persistent access
Abusing OAuth consent flows and permissions
Manipulating authentication flows at the protocol level
This category consolidates ETS-002, ETS-003, ETS-005, ETS-006 and their equivalents into actionable executive intelligence.
Attackers overwhelm users with MFA prompts through "MFA fatigue" campaigns, redirect them through authentic-looking reverse proxies, or trick them into approving OAuth applications that grant full account access without password compromise.
What Attackers Exploit
User confusion during high-pressure scenarios
MFA push notification bombardment
Approval fatigue from repeated prompts
Misleading consent screens designed to deceive
Reverse-proxy MFA interception using Evilginx-like frameworks
Business Impact
The attacker logs in as the legitimate user — with valid MFA credentials — without ever needing to steal passwords. This represents a complete bypass of your primary authentication control.
Attackers simultaneously test thousands of known passwords across corporate tenants using automated frameworks. A single weak password becomes the entry point for complete cloud environment compromise.
2
Exploitation Vectors
Reused passwords from previous breaches, weak passwords in hybrid directories, legacy authentication endpoints that lack modern protections, and passwords synchronized from unmanaged or shadow IT systems.
3
Critical Impact
One compromised low-privilege user account becomes the initial foothold for privilege escalation to cloud administrator roles. From there, attackers pivot to high-value assets and establish persistence.
Modern attacks no longer steal credentials — they steal sessions. A stolen refresh token or session cookie can bypass MFA entirely, rendering password complexity and multi-factor authentication completely ineffective.
Even if passwords are rotated immediately and MFA is enforced across all accounts, attackers remain authenticated indefinitely through compromised session artifacts.
What Attackers Target
Browser cookies containing authentication state
Long-lived refresh tokens with excessive validity periods
OAuth authorization codes intercepted during flow
Machine identities storing tokens insecurely
Endpoint session artifact exposure through malware
Attackers deploy malicious third-party OAuth applications, tricking users into granting full API or mailbox access — no credential theft required. The user believes they're authorizing a legitimate business tool.
Exploitation Techniques
Permissive tenant application consent policies allow users to self-consent to dangerous permissions. Misleading OAuth screens obscure true intent, while excessive API scopes grant broader access than necessary. Unmanaged multi-tenant apps operate outside security visibility.
Strategic Impact
The attacker receives a permanent token pipeline and bypasses identity governance entirely. This creates an ongoing data exfiltration channel that persists even after the initial compromise is discovered and remediated.
Systematic enumeration of valid user accounts through authentication endpoint probing, error message analysis, and directory reconnaissance to build target lists.
Distributed authentication attempts using common passwords across many accounts to avoid account lockout thresholds while maximizing compromise probability.
Understanding the human and organizational factors that enable these attacks
Human Error Under Pressure
Users make poor security decisions when facing tight deadlines, urgent requests from apparent authority figures, or during high-stress situations that reduce critical thinking.
Inconsistent Identity Governance
Fragmented policies across cloud platforms, inadequate lifecycle management for identities, and lack of unified visibility into authentication events and access patterns.
Weak MFA Design
Over-reliance on push notifications without context, lack of phishing-resistant authentication methods, and missing risk-based authentication triggers.
Excessive Trust in Third-Party Apps
Assumption that OAuth consent screens indicate safe applications, insufficient due diligence on third-party integrations, and lack of ongoing monitoring for granted permissions.