Threat actors downgrade FIDO2 MFA auth in PoisonSeed phishing attack

The 'PoisonSeed' phishing campaign, known for large-volume financial fraud, is now effectively bypassing FIDO2 security key protections by exploiting the legitimate WebAuthn cross-device sign-in feature. This sophisticated attack uses an adversary-in-the-middle technique to present a QR code on impersonated login portals, tricking users into approving attacker-initiated logins via their secondary devices, thus circumventing the intended phishing resistance of FIDO2 keys. This development underscores an escalating threat where robust authentication mechanisms are compromised through feature abuse and social engineering, rather than direct exploits, posing a critical risk for organizations relying on such security.

Analysis

A sophisticated phishing campaign dubbed 'PoisonSeed' is circumventing FIDO2 security key protections, a development that poses a significant risk to enterprise security. The attack vector does not exploit a technical flaw within FIDO2 but rather abuses the legitimate cross-device sign-in feature of WebAuthn. Through an adversary-in-the-middle (AiTM) attack, threat actors impersonate corporate login portals for services like Microsoft 365 and Okta, tricking users into scanning a malicious QR code that approves the attacker's login attempt on a separate device. This method effectively downgrades the authentication process and bypasses the intended physical security of FIDO2 keys. The neutral sentiment scores for Microsoft (MSFT) and Okta (OKTA) indicate the market correctly perceives this not as a platform-specific vulnerability but as an industry-wide challenge in social engineering that erodes trust in even advanced multi-factor authentication (MFA) standards.

Key Decisions for Investors

• The demonstrated bypass of FIDO2 creates a potential tailwind for cybersecurity firms offering layered defenses, such as advanced threat detection, user behavior analytics, and identity and access management solutions that go beyond standard MFA.
• While not a direct flaw in their products, investors in identity providers like Okta and Microsoft should monitor for company responses and feature enhancements aimed at mitigating this type of feature abuse, such as enforcing stricter cross-device authentication policies.
• This attack vector highlights the persistent vulnerability of the human element in security, suggesting that investors should favor companies with a comprehensive 'defense-in-depth' security posture over those relying solely on a single technology like FIDO2 as a silver bullet.