New Downgrade Attack Can Bypass FIDO Auth in Microsoft Entra ID

New downgrade attack can bypass FIDO auth in Microsoft Entra ID

Security researchers have created a new FIDO downgrade attack against Microsoft Entra ID that tricks users into authenticating with weaker login methods, making them susceptible to phishing and session hijacking.

Microsoft Entra ID attack weakens authentication

New FIDO downgrade attack threatens Microsoft Entra ID by forcing users to use weaker authentication, enabling phishing.

New Downgrade Attack Can Bypass FIDO Auth In Microsoft Entra ID - Cybernoz - Cybersecurity News

Security researchers have created a new FIDO downgrade attack against Microsoft Entra ID that tricks users into authenticating with weaker login methods, making them susceptible to phishing and session hijacking. These weaker login channels are vulnerable to adversary-in-the-middle phishing attacks that employ tools like Evilginx, enabling attackers to snatch valid session cookies and hijack the accounts. Although the attack doesn’t prove a vuln…

Hackers Deploy Dedicated Phishlet for FIDO Authentication Downgrade Attacks

Proofpoint researchers have uncovered a novel technique allowing threat actors to bypass FIDO-based authentication through downgrade attacks, leveraging a custom phishlet within adversary-in-the-middle (AiTM) frameworks. This method exploits gaps in browser compatibility and user agent handling, forcing victims to revert to less secure multi-factor authentication (MFA) mechanisms, thereby enabling credential theft and session hijacking. While [……

FIDO Passkey Security Flaw Enables Authentication Downgrade Attacks

A newly discovered vulnerability in FIDO passkey authentication systems allows attackers to bypass their phishing-resistant security by forcing authentication through less secure legacy methods. The downgrade attack exploits inconsistent passkey support across different operating systems and browsers, potentially enabling adversary-in-the-middle (AiTM) phishing attacks. The discovery comes at a critical time when major technology companies like …