PoisonSeed Attack Exploits QR Codes to Bypass MFA Authentication

Cybersecurity firm Expel has uncovered a sophisticated new phishing technique by the PoisonSeed group that effectively bypasses FIDO key security by exploiting legitimate cross-device sign-in functionality. This adversary-in-the-middle (AitM) attack tricks users into inadvertently authenticating attackers, neutralizing the FIDO key's robust protection. The discovery highlights the increasing vulnerability of identity-based security, which now accounts for 66.2% of security incidents according to Expel's Q1 2025 threat report, underscoring the critical need for enhanced authentication monitoring and controls for organizations.

Analysis

Cybersecurity researchers at Expel have identified a significant evolution in identity-based threats with a new adversary-in-the-middle (AitM) attack that circumvents FIDO key protections. The technique, attributed to the PoisonSeed group, weaponizes legitimate cross-device sign-in functionality by tricking users into scanning a malicious QR code, thereby granting attackers full account access. This development is highly relevant as it neutralizes a security standard previously considered robust. The vulnerability is contextualized by Expel's Q1 2025 finding that identity-based attacks now comprise 66.2% of all security incidents, indicating a systemic shift in the threat landscape. The attack's effectiveness underscores that technological safeguards alone are insufficient without comprehensive monitoring for anomalies, such as unusual FIDO key registrations or suspicious login geographies. This incident signals a continuous escalation in cyber warfare, increasing pressure on organizations to adopt more sophisticated, multi-layered defense-in-depth strategies beyond simple multi-factor authentication.

Key Decisions for Investors

• The growing sophistication of attacks bypassing advanced authentication strengthens the investment case for cybersecurity firms specializing in identity and access management (IAM), threat intelligence, and behavioral analytics, as enterprises will be forced to upgrade their defensive stacks.
• Investors should assess the heightened operational risk within their portfolio, particularly in tech and finance, as the weaponization of legitimate sign-in features indicates a broader vulnerability that could lead to significant financial or data losses.
• Given the attack's association with cryptocurrency phishing, positions in the digital asset ecosystem face elevated risk, warranting a review of the security diligence applied to crypto exchanges, wallets, and custodial services.