Threat Actors Exploit FIDO2 MFA in PoisonSeed Phishing Campaign

TL;DR

• A PoisonSeed phishing campaign is bypassing FIDO2 security key protections.
• Threat actors are abusing the cross-device sign-in feature in WebAuthn.
• Users are tricked into approving login authentication requests from fake company portals.

Main Content

A sophisticated PoisonSeed phishing campaign has been identified, targeting FIDO2 security key protections. This campaign exploits the cross-device sign-in feature in WebAuthn to bypass multi-factor authentication (MFA) mechanisms. By tricking users into approving login authentication requests from fake company portals, threat actors are able to gain unauthorized access to sensitive information.

Understanding FIDO2 and WebAuthn

FIDO2 (Fast Identity Online 2) is a set of standards for secure and convenient authentication. It includes the WebAuthn specification, which enables strong, public-key cryptography registration and authentication of users to web services. This technology is designed to enhance security by requiring a second factor of authentication, typically a physical security key or biometric verification.

The PoisonSeed Phishing Campaign

The PoisonSeed campaign leverages social engineering tactics to deceive users. Here’s how it works:

1. Phishing Emails: Users receive phishing emails that mimic legitimate company communications.
2. Fake Portals: These emails direct users to fake company portals that closely resemble authentic login pages.
3. Authentication Requests: Users are prompted to approve login authentication requests, which are actually initiated by the threat actors.
4. Cross-Device Sign-In: The cross-device sign-in feature in WebAuthn is abused to complete the authentication process, bypassing the security key protections.

Implications and Mitigation

The success of this campaign highlights the ongoing challenges in securing authentication processes. To mitigate such threats, organizations and individuals should:

• Educate Users: Conduct regular training sessions to help users recognize and avoid phishing attempts.
• Implement Advanced MFA: Use multi-factor authentication methods that include biometric verification or physical security keys.
• Monitor and Respond: Continuously monitor for suspicious activities and respond promptly to any detected threats.

Conclusion

The PoisonSeed phishing campaign serves as a reminder of the evolving tactics used by threat actors to bypass security measures. By staying informed and proactive, organizations can better protect themselves against such advanced threats.

Additional Resources

For further insights, check:

• BleepingComputer: Threat Actors Downgrade FIDO2 MFA Auth in PoisonSeed Phishing Attack

References