Sign-in via pre-registered PhoneAppOTP MFA on compromised credentials

Ibrahim Saud@tektrix

•updated Sep 18, 2026•3•0•4

Detects instances where a user account registers the PhoneAppOTP MFA method and subsequently performs a successful authentication using that method within a defined window, followed by authentication attempts originating from non-browser, likely automated, UserAgents (e.g., node, python, axios). This pattern may indicate an adversary who has registered their own MFA device to gain persistent, automated access to the account.