AiTM phishing: error 50074 then 50140 on unmanaged device sign-in

Ibrahim Saud@tektrix

•updated Sep 16, 2026•3•0•3

Detects anomalous sign-in activity where a user triggers both Error Code 50074 (MFA required) and 50140 (MFA bypass occurred or not required/invalidated) in a short window of time (less than 1 hour). The rule looks for sessions on unmanaged devices (empty TrustType) using Chrome, which may indicate an adversary attempting to bypass or manipulate MFA enrollment or verification flows.