AiTM Phishing with QR Code to Bypass FIDO
Detects successful Okta authentication using the FIDO/WebAuthn cross-device (hybrid) sign-in feature. This technique is abused by attackers in Adversary-in-the-Middle (AiTM) phishing campaigns, like those conducted by PoisonSeed, to bypass FIDO MFA by tricking a user into scanning a malicious QR code.
Sigma
