The Identity Breach Era: Why 2025-2026 Changed Everything

For years, the cybersecurity industry told small businesses one thing: turn on MFA and you're safe. That advice is now dangerously incomplete. From the casino floors of Las Vegas to the Microsoft 365 tenants of mid-market Australian firms, attackers have demonstrated — repeatedly — that MFA is a speed bump, not a wall.

Between 2023 and early 2026, a series of high-impact identity-layer breaches rewrote the threat landscape. The common thread: attackers didn't break encryption or crack passwords. They manipulated trust chains — the human and technical assumptions that sit between authentication steps. For Australian SMBs running Microsoft 365, Google Workspace, or SaaS-heavy stacks, these tactics are being deployed at scale right now.

Three Breaches That Redefined the Identity Threat

1. Scattered Spider and the Help-Desk Kill Chain (2023, Still Active)

In September 2023, the ALPHV/BlackCat ransomware gang — working with a loosely organised social-engineering collective known as Scattered Spider — breached MGM Resorts and Caesars Entertainment. The attack didn't start with malware. It started with a phone call.

Attackers researched employees on LinkedIn, called the internal IT help desk, impersonated those employees, and convinced support staff to reset MFA tokens and enrol new devices. Once inside the Okta environment, they moved laterally into financial systems and guest services. MGM estimated losses of over $100 million. Caesars reportedly paid a $15 million ransom.

How MFA failed: The help desk was the MFA bypass. No credential was stolen — just trust was exploited. This technique, known as vishing (voice phishing), remains the most reliable way into an otherwise well-defended identity environment.

Mandiant's January 2026 disclosure of new ShinyHunters activity (tracked as UNC6661 and UNC6671) confirmed this pattern is accelerating. Attackers posed as IT staff, directed employees to credential-harvesting sites styled to match the victim's own company, and captured both SSO credentials and one-time MFA codes in real time. Once armed with valid sessions, they registered attacker-controlled devices for MFA, exfiltrated SharePoint and OneDrive data, and launched extortion campaigns. Okta confirmed customer accounts were compromised.

2. Storm-0558 and the Microsoft Signing Key Compromise (2023)

In mid-2023, a Chinese state-linked actor tracked as Storm-0558 gained access to Outlook Web Access and Exchange Online across dozens of organisations — including US government agencies — by compromising a Microsoft consumer signing key. The attacker forged OAuth tokens that appeared to have been signed by Microsoft's own Entra ID infrastructure.

How MFA failed: The forged tokens were cryptographically valid. Microsoft's own systems trusted them. No MFA prompt was triggered because, from the identity provider's perspective, the token had already been issued legitimately. The breach exposed a fundamental truth: if the signing key trust chain is compromised, every downstream MFA-dependent system becomes irrelevant.

3. EvilProxy, Tycoon, and the Industrialisation of AiTM Phishing (2024-2026)

Adversary-in-the-middle (AiTM) phishing has exploded. Kits like EvilProxy and Tycoon sit between the victim and the legitimate login page — Microsoft 365, Google Workspace, Okta — and capture both the password and the session token issued after successful MFA completion. The victim completes MFA. The attacker receives the token. The victim sees a legitimate-looking post-login redirect. Nobody notices until data is exfiltrated.

Obsidian Security reported that token theft accounted for 31% of Microsoft 365 breaches in 2025, surpassing traditional credential compromise. Nearly 40,000 AiTM incidents were detected daily across Microsoft environments — a 146% increase. The stolen token grants access without re-triggering MFA because the system treats it as an already-authenticated session. Password resets, MFA invalidation, and even account suspension (in some implementations) do nothing — the token survives until explicitly revoked.

Three Defences Australian SMBs Can Deploy This Month

These are not enterprise-only controls. They work for five-person consultancies and 200-person manufacturers alike.

1. Help-Desk Verification Protocols (Stops Vishing Dead)

Scattered Spider and ShinyHunters succeeded because help desks trusted a voice on the phone. Implement a two-channel verification rule: no MFA reset, device enrolment, or password change over the phone without a second verification channel. Require a live video call where the person holds up photo ID, or use a pre-registered mobile number callback. If your IT support is outsourced, this rule must be contractual. Document every identity-reset event and flag any request that arrives outside business hours — that's when Mandiant observed most ShinyHunters-style activity.

2. Number Matching and Phishing-Resistant MFA (Kills AiTM)

Push-based MFA (tap "Approve" on your phone) and SMS codes are phishing-prone. Attackers can relay both. Implement number matching in Microsoft Authenticator: the user must type a two-digit number displayed on the login screen into their authenticator app. This breaks the AiTM relay because the attacker's proxy can't display the number in the victim's context without the victim noticing.

Even stronger: deploy FIDO2 security keys or passkeys. These are cryptographically bound to the login domain — a phishing proxy for login.microsoftonline.com cannot replay a FIDO2 assertion to the real service. Google's Advanced Protection Program and Microsoft's phishing-resistant MFA policies both support this at no additional licence cost for most M365 Business Premium tenants.

3. Session Token Monitoring and Admin Activity Alerting (Catches What Gets Through)

If a token is stolen, you need to detect its use, not its theft. Configure alerting for:

• Impossible travel: A session token used from Melbourne, then from Lagos within 10 minutes.
• Unfamiliar IP ranges or User-Agent strings: Attackers often use commodity VPS or residential proxy networks that differ from your normal patterns.
• Admin role assignment or privileged activity outside business hours: ShinyHunters actors registered MFA devices and created mailbox rules at 2:00 AM local time. Microsoft 365 Unified Audit Log and Entra ID sign-in logs surface this — but you must configure the alerts.

SaaS security posture management tools (many with free tiers for under 50 seats) automate this for Microsoft 365 and Google Workspace. The Australian Signals Directorate's Essential Eight explicitly calls for event logging and anomaly detection at Maturity Level 2 and above.

FAQ

Conclusion

The identity layer is the new perimeter, and it's under sustained assault. MFA bought years of protection, but the threat has evolved — attackers now target the gaps between authentication steps: the help desk, the signing key trust chain, and the session token. Australian SMBs that layer help-desk verification protocols, phishing-resistant MFA with number matching, and session token alerting close those gaps without enterprise-level budgets.

Every week without these controls is a week your MFA is theatre, not defence.

Next step: Visit consult.lil.business for a free 30-minute cybersecurity assessment tailored to Australian SMBs. Get your identity-layer controls reviewed before an attacker does it for you.

References

1. Mandiant Finds ShinyHunters-Style Vishing Attacks Stealing MFA to Breach SaaS Platforms — The Hacker News, January 2026

2. Token-Based Attacks: How Attackers Bypass MFA — Obsidian Security, February 2026

3. Identity is the New Perimeter — How Attackers Bypass MFA in 2026 — Security In 45

4. OAuth Token Theft: Why Your SSO and MFA Won't Save You — OpSec Forge, 2026

5. Inside an AI‑Enabled Device Code Phishing Campaign — Microsoft Security Blog, April 2026

6. Abusing Trust: OAuth, SSO, and Identity as the New Attack Surface — Cynox Security (Medium)