MFA Enrollment/Device Registration via Proxy

nomit vyas@xoxo

•updated Jun 24, 2026•1•0•4

Detects MFA factor activation, device enrollment, and password resets originating from residential/commercial proxy infrastructure, often associated with threat groups like BlackFile/UNC6671/Cordial Spider.