MFA verifies who logged in. It has no idea what they do next.

What happens after MFA succeeds? How session token theft lets attackers move laterally through enterprise networks without ...

Inside the REMUS Infostealer: Session Theft, MaaS, and Rapid Evolution

Stolen browser sessions and authentication tokens are becoming more valuable than stolen passwords. Flare explains how the ...
Tech Times

Exchange Server OWA Zero-Day CVE-2026-42897 Exploited With No Permanent Patch and New Mitigation Gaps

Microsoft confirmed on May 14 that CVE-2026-42897 — a cross-site scripting flaw in the Outlook Web Access component of Exchange Server 2016, 2019, and Subscription Edition — is under active ...
Computerworld

Chrome Token-Theft Extensions, Nadella Europe Sovereignty, ChatGPT Age-Checks | Ep. 41

In today’s 2-Minute Tech Briefing, researchers flag fake Chrome productivity extensions stealing session tokens from Workday, NetSuite, and SuccessFactors. Satya Nadella argues Europe’s sovereignty ...
CSOonline

Okta support system breach highlights need for strong MFA policies

Attackers managed to breach identity and access management company Okta’s support system using stolen credentials and extracted valid customer session tokens from uploaded support files, according to ...
Hosted on MSN

Students Build Real-World Defense Against 2026's Evolving Cyber Threats

The cybersecurity landscape has shifted dramatically in 2026: while Multi-Factor Authentication (MFA) is now standard, it's no longer the silver bullet it was once thought to be. Recent breach ...
Hosted on MSN

Microsoft Teams Token Replay Attack: What Happened and Fixes

An existing dysfunction on the patient side of Microsoft Teams provided the opportunity for an adversary with local access to replay session tokens. Microsoft has patched this. This article will ...