The dominant attack on financial services does not steal passwords. It resets MFA and steals the token.

The attacker who hit the most financial services organizations in the past 12 months never committed a password spoof. They called the IT support line, convinced the employee to reset the MFA, and registered their device on the network. CrowdStrike…




