Multi-Factor Authentication: Not the Silver Bullet
Multi-Factor Authentication (MFA) is a widely used security measure, but it's not bulletproof. See how threat actors can exploit MFA to access your information.
Darktrace cyber analysts are world-class experts in threat intelligence, threat hunting and incident response, and provide 24/7 SOC support to thousands of Darktrace customers around the globe. Inside the SOC is exclusively authored by these experts, providing analysis of cyber incidents and threat trends, based on real-world experience in the field.
Written by
Tegbir Singh
Cyber Analyst
Written by
Emma Foulger
Global Threat Research Operations Lead
Share
20
Mar 2023
Multi-Factor Authentication (MFA) is a long-established component of the identity and access management (IAM) framework that requires users to provide multiple verification factors to access Software as a Service (SaaS) and application environments, rather than simply relying on account credentials. MFA has been widely, although not universally, adopted as a security measure against common account takeover methods, such as brute-force attacks and exploiting passwords found in data leaks. Despite the adoption of MFA, account takeover methods are still prevalent across the threat landscape. However, the industry is seeing more and more examples of MFA compromise wherein threat actors exploit the security tool itself to gain account access.
Although having a security measure like MFA is a crucial first step in safeguarding a network, relying on a single method will always lead to gaps. MFA is a generic term for a broad range of products and services with varying degrees of efficacy; however, it is often used in the same way as Zero Trust, as a tick box or one size fits all solution. Knowing the gaps in security that are still present, even when utilizing effective MFA tools, is essential to mitigating the evolving threats of account compromise.
Figure 1: The standard flow process of MFA for any individual application.
Bypassing MFA & Attack Details
Instances of threat actors’ bypassing MFA typically involve an element of social engineering, such as spamming authentication requests to the victim’s email or phone. This takes advantage of the victim’s fatigue of receiving numerous notifications, leading them to validate the request to silence the notifications. Microsoft research data published in September 2022 shows a clear trend of MFA fatigue attacks becoming increasingly popular last year [1]. Notably, the Uber hack occurred after attackers exploited this method [2]. This trend seems likely to continue as MFA progresses towards universal adoption and attackers continue to focus on social engineering as a means to bypass it. The following example details how Darktrace not only identifies and warns customers about unusual MFA activity for hijacked accounts, but also how its suite of products can take appropriate actions to prevent further compromise.
On January 5, 2023, a SaaS account belonging to a customer based in Australia was observed successfully logging in from a rare external endpoint, following two previous failed attempts. Darktrace identified that the login IP address was in the United States, which it recognized as unusual compared to the user’s expected login location, and the successful login followed multiple failed MFA authentication requests.
Figure 2: A screenshot of the SaaS console, showcasing the login activity of the SaaS user with the reason for the failed logins highlighted.
No further suspicious activity was detected on the device, likely a tactic employed by the threat actor to remain undetected by security tools. However, a Darktrace model breach was triggered two days later following another usual login location, this time in Germany. Once again, a successful authentication request was observed, suggesting the attacker was able to consistently bypass the MFA security and access the account.
Following this login, multiple unusual activities were observed including the access of multiple sensitive internal files and initiating updates to email folders, namely \Sent Items, \Deleted Items, and \WIISE. This type of activity is indicative of a victim’s mailbox being modified to enable attackers to send malicious spam to contacts in the organization, allowing them to escalate their privileges and move laterally throughout the network.
Figure 3: A screenshot of the SaaS console showing some of the suspicious files that were previewed by the user.
Darktrace continued to report suspicious activity from this user with similar activity occurring again on January 8, when the user was observed logging in from another highly anomalous location and accessing similar files. The activity escalated on January 13 when, alongside an unusual login and further email updates, the user created a new email rule suspiciously named “.”.
Figure 4: A screenshot showcasing the details of the email rule that was created by the malicious actor.
The rule appears to have targeted emails received from a specific internal user, marking them as read and moving them to a different folder; it was likely that the attacker intended to use these emails to help socially engineer third-parties and compromise the organization’s network further. Additional suspicious activity was observed from the user, including an update to an email containing a potentially sensitive attachment.
Figure 5: A screenshot showing details of the attachment observed.
Due to the combination of an unusual login and new email rule, Darktrace RESPOND/Network™ took swift autonomous action, forcing the user in question to log out and disabling the account, preventing further compromise. With the implementation of these actions the malicious actor was unable to engage in any further activity on the compromised account.
Figure 6: The above screenshot of the SaaS UI shows some of the actions initiated by Darktrace RESPOND/Network.
Conclusion
Having MFA in place is an important first step towards hardening an organization’s SaaS environment and safeguarding against less sophisticated methods of attack, however defense in depth is key to ensuring a network is truly secure. Any one security measure will always have weaknesses, and only with multiple layers of varying protection can gaps in security be effectively closed.
Using Self-Learning AI™, Darktrace DETECT™ can quickly identify unexpected behavior on a device, even if it occurs with legitimate credentials and successfully passes MFA, to bring it to the attention of the security team. Darktrace RESPOND™ is then able to take immediate action, implementing precise actions to prevent more serious compromise.
Pairing the two products together provides customers with an around-the-clock AI decision maker capable of detecting emerging threats, even those that would evade other traditional security measures, and interrupting attacks at machine speed with surgical precision.
Darktrace cyber analysts are world-class experts in threat intelligence, threat hunting and incident response, and provide 24/7 SOC support to thousands of Darktrace customers around the globe. Inside the SOC is exclusively authored by these experts, providing analysis of cyber incidents and threat trends, based on real-world experience in the field.
From VPS to Phishing: How Darktrace Uncovered SaaS Hijacks through Virtual Infrastructure Abuse
Darktrace identified coordinated SaaS account compromises across multiple customer environments. The incidents involved suspicious logins from VPS-linked infrastructure followed by unauthorized inbox rule creation and deletion of phishing-related emails. These consistent behaviors across devices point to a targeted phishing campaign leveraging virtual infrastructure for access and concealment. Discover how Darktrace uncovered this activity and what it means for the future of SaaS security.
Defending the Cloud: Stopping Cyber Threats in Azure and AWS with Darktrace
This blog examines three real-world cloud-based attacks in Azure and AWS environments, including credential compromise, data exfiltration, and ransomware detonation. Learn how Darktrace’s AI-driven threat detection and Autonomous Response capabilities help organizations defend against evolving threats in complex cloud environments.
Top Eight Threats to SaaS Security and How to Combat Them
SaaS security requires new methods to keep up with evolving threats and business infrastructure. In this blog, learn the top eight threats to identity security and how AI-based solutions can help.
When Trust Becomes the Attack Surface: Supply-Chain Attacks in an Era of Automation and Implicit Trust
Software supply-chain attacks in 2026
Software supply-chain attacks now represent the primary threat shaping the 2026 security landscape. Rather than relying on exploits at the perimeter, attackers are targeting the connective tissue of modern engineering environments: package managers, CI/CD automation, developer systems, and even the security tools organizations inherently trust.
These incidents are not isolated cases of poisoned code. They reflect a structural shift toward abusing trusted automation and identity at ecosystem scale, where compromise propagates through systems designed for speed, not scrutiny. Ephemeral build runners, regardless of provider, represent high‑trust, low‑visibility execution zones.
The Axios compromise and the cascading Trivy campaign illustrate how quickly this abuse can move once attacker activity enters build and delivery workflows. This blog provides an overview of the latest supply chain and security tool incidents with Darktrace telemetry and defensive actions to improve organizations defensive cyber posture.
1. Why the Axios Compromise Scaled
On 31 March 2026, attackers hijacked the npm account of Axios’s lead maintainer, publishing malicious versions 1.14.1 and 0.30.4 that silently pulled in a malicious dependency, plain‑crypto‑[email protected]. Axios is a popular HTTP client for node.js and processes 100 million weekly downloads and appears in around 80% of cloud and application environments, making this a high‑leverage breach [1].
The attack chain was simple yet effective:
A compromised maintainer account enabled legitimate‑looking malicious releases.
The poisoned dependency executed Remote Access Trojans (RATs) across Linux, macOS and Windows systems.
The malware beaconed to a remote command-and-control (C2) server every 60 seconds in a loop, awaiting further instructions.
The installer self‑cleaned by deleting malicious artifacts.
All of this matters because a single maintainer compromise was enough to project attacker access into thousands of trusted production environments without exploiting a single vulnerability.
A view from Darktrace
Multiple cases linked with the Axios compromise were identified across Darktrace’s customer base in March 2026, across both Darktrace / NETWORK and Darktrace / CLOUD deployments.
In one Darktrace / CLOUD deployment, an Azure Cloud Asset was observed establishing new external HTTP connectivity to the IP 142.11.206[.]73 on port 8000. Darktrace deemed this activity as highly anomalous for the device based on several factors, including the rarity of the endpoint across the network and the unusual combination of protocol and port for this asset. As a result, the triggering the "Anomalous Connection / Application Protocol on Uncommon Port" model was triggered in Darktrace / CLOUD. Detection was driven by environmental context rather than a known indicator at the time. Subsequent reporting later classified the destination as malicious in relation to the Axios supply‑chain compromise, reinforcing the gap that often exists between initial attacker activity and the availability of actionable intelligence. [5]
Additionally, shortly before this C2 connection, the device was observed communicating with various endpoints associated with the NPM package manager, further reinforcing the association with this attack.
Figure 1: Darktrace’s detection of the unusual external connection to 142.11[.]206[.]73 via port 8000.
Within Axios cases observed within Darktrace / NETWORK customer environments, activity generally focused on the use of newly observed cURL user agents in outbound connections to the C2 URL sfrclak[.]com/6202033, alongside the download of malicious files.
In other cases, Darktrace / NETWORK customers with Microsoft Defender for Endpoint integration received alerts flagging newly observed system executables and process launches associated with C2 communication.
Figure 2: A Security Integration Alert from Microsoft Defender for Endpoint associated with the Axios supply chain attack.
2. Why Trivy bypassed security tooling trust
Between late February and March 22, 2026, the threat group TeamPCP leveraged credentials from a previous incident to insert malicious artifacts across Trivy’s distribution ecosystem, including its CI automation, release binaries, Visual Studio Code extensions, and Docker container images [2].
While public reporting has emphasized GitHub Actions, Darktrace telemetry highlights attacker execution within CI/CD runner environments, including ephemeral build runners. These execution contexts are typically granted broad trust and limited visibility, allowing malicious activity within build automation to blend into expected operational workflows, regardless of provider.
This was a coordinated multi‑phase attack:
75 of 76 of trivy-action tags and all setup‑trivy tags were force‑pushed to deliver a malicious payload.
A malicious binary (v0.69.4) was distributed across all major distribution channels.
Developer machines were compromised, receiving a persistent backdoor and a self-propagating worm.
Secrets were exfiltrated at scale, including SSH keys, Kuberenetes tokens, database passwords, and cloud credentials across Amazon Web Service (AWS), Azure, and Google Cloud Platform (GCP).
Within Darktrace’s customer base, an AWS EC2 instance monitored by Darktrace / CLOUD appeared to have been impacted by the Trivy attack. On March 19, the device was seen connecting to the attacker-controlled C2 server scan[.]aquasecurtiy[.]org (45.148.10[.]212), triggering the model 'Anomalous Server Activity / Outgoing from Server’ in Darktrace / CLOUD.
Despite this limited historical context, Darktrace assessed this activity as suspicious due to the rarity of the destination endpoint across the wider deployment. This resulted in the triggering of a model alert and the generation of a Cyber AI Analyst incident to further analyze and correlate the attack activity.
TeamPCP’s continued abused of GitHub Actions against security and IT tooling has also been observed more recently in Darktrace’s customer base. On April 22, an AWS asset was seen connecting to the C2 endpoint audit.checkmarx[.]cx (94.154.172[.]43). The timing of this activity suggests a potential link to a malicious Bitwarden package distributed by the threat actor, which was only available for a short timeframe on April 22. [4][3]
Figure 3: A model alert flagging unusual external connectivity from the AWS asset, as seen in Darktrace / CLOUD .
While the Trivy activity originated within build automation, the underlying failure mode mirrors later intrusions observed via management tooling. In both cases, attackers leveraged platforms designed for scale and trust to execute actions that blended into normal operational noise until downstream effects became visible.
Quest KACE: Legacy Risk, Real Impact
The Quest KACE System Management Appliance (SMA) incident reinforces that software risk is not confined to development pipelines alone. High‑trust infrastructure and management platforms are increasingly leveraged by adversaries when left unpatched or exposed to the internet.
Throughout March 2026, attackers exploited CVE 2025-32975 to authentication on outdated, internet-facing KACE appliances, gaining administrative control and pushing remote payloads into enterprise environments. Organizations still running pre-patch versions effectively handed adversaries a turnkey foothold, reaffirming a simple strategic truth: legacy management systems are now part of the supply-chain threat surface, and treating them as “low-risk utilities” is no longer defensible [3].
Within the Darktrace customer base, a potential case was identified in mid-March involving an internet-facing server that exhibited the use of a new user agent alongside unusual file downloads and unexpected external connectivity. Darktrace identified the device downloading file downloads from "216.126.225[.]156/x", "216.126.225[.]156/ct.py" and "216.126.225[.]156/n", using the user agents, "curl/8.5.0" & "Python-urllib/3.9".
The timeframe and IoCs observed point towards likely exploitation of CVE‑2025‑32975. As with earlier incidents, the activity became visible through deviations in expected system behavior rather than through advance knowledge of exploitation or attacker infrastructure. The delay between observed exploitation and its addition to the Known Exploited Vulnerabilities (KEV) catalogue underscores a recurring failure: retrospective validation cannot keep pace with adversaries operating at automation speed.
The strategic pattern: Ecosystem‑scale adversaries
The Axios and Trivy compromises are not anomalies; they are signals of a structural shift in the threat landscape. In this post-trust era, the compromise of a single maintainer, repository token, or CI/CD tag can produce large-scale blast radiuses with downstream victims numbering in the thousands. Attackers are no longer just exploiting vulnerabilities; they are exploiting infrastructure privileges, developer trust relationships, and automated build systems that the industry has generally under secured.
Supply‑chain compromise should now be treated as an assumed breach scenario, not a specialized threat class, particularly across build, integration, and management infrastructure. Organizations must operate under the assumption that compromise will occur within trusted software and automation layers, not solely at the network edge or user endpoint. Defenders should therefore expect compromise to emerge from trusted automation layers before it is labelled, validated, or widely understood.
The future of supply‑chain defense lies in continuous behavioral visibility, autonomous detection across developer and build environments, and real‑time anomaly identification.
As AI increasingly shapes software development and security operations, defenders must assume adversaries will also operate with AI in the loop. The defensive edge will come not from predicting specific compromises, but from continuously interrogating behavior across environments humans can no longer feasibly monitor at scale.
Credit to Nathaniel Jones (VP, Security & AI Strategy, FCISCO), Emma Foulger (Global Threat Research Operations Lead), Justin Torres (Senior Cyber Analyst), Tara Gould (Malware Research Lead)
How email-delivered prompt injection attacks can target enterprise AI – and why it matters
What are email-delivered prompt injection attacks?
As organizations rapidly adopt AI assistants to improve productivity, a new class of cyber risk is emerging alongside them: email-delivered AI prompt injection. Unlike traditional attacks that target software vulnerabilities or rely on social engineering, this is the act of embedding malicious or manipulative instructions into content that an AI system will process as part of its normal workflow. Because modern AI tools are designed to ingest and reason over large volumes of data, including emails, documents, and chat histories, they can unintentionally treat hidden attacker-controlled text as legitimate input.
At Darktrace, our analysis has shown an increase of 90% in the number of customer deployments showing signals associated with potential prompt injection attempts since we began monitoring for this type of activity in late 2025. While it is not always possible to definitively attribute each instance, internal scoring systems designed to identify characteristics consistent with prompt injection have recorded a growing number of high-confidence matches. The upward trend suggests that attackers are actively experimenting with these techniques.
Recent examples of prompt injection attacks
Two early examples of this evolving threat are HashJack and ShadowLeak, which illustrate prompt injection in practice.
HashJack is a novel prompt injection technique discovered in November 2025 that exploits AI-powered web browsers and agentic AI browser assistants. By hiding malicious instructions within the URL fragment (after the # symbol) of a legitimate, trusted website, attackers can trick AI web assistants into performing malicious actions – potentially inserting phishing links, fake contact details, or misleading guidance directly into what appears to be a trusted AI-generated output.
ShadowLeak is a prompt injection method to exfiltrate PII identified in September 2025. This was a flaw in ChatGPT (now patched by OpenAI) which worked via an agent connected to email. If attackers sent the target an email containing a hidden prompt, the agent was tricked into leaking sensitive information to the attacker with no user action or visible UI.
What’s the risk of email-delivered prompt injection attacks?
Enterprise AI assistants often have complete visibility across emails, documents, and internal platforms. This means an attacker does not need to compromise credentials or move laterally through an environment. If successful, they can influence the AI to retrieve relevant information seamlessly, without the labor of compromise and privilege escalation.
The first risk is data exfiltration. In a prompt injection scenario, malicious instructions may be embedded within an ordinary email. As in the ShadowLeak attack, when AI processes that content as part of a legitimate task, it may interpret the hidden text as an instruction. This could result in the AI disclosing sensitive data, summarizing confidential communications, or exposing internal context that would otherwise require significant effort to obtain.
The second risk is agentic workflow poisoning. As AI systems take on more active roles, prompt injection can influence how they behave over time. An attacker could embed instructions that persist across interactions, such as causing the AI to include malicious links in responses or redirect users to untrusted resources. In this way, the attacker inserts themselves into the workflow, effectively acting as a man-in-the-middle within the AI system.
Why can’t other solutions catch email-delivered prompt injection attacks?
AI prompt injection challenges many of the assumptions that traditional email security is built on. It does not fit the usual patterns of phishing, where the goal is to trick a user into clicking a link or opening an attachment.
Most security solutions are designed to detect signals associated with user engagement: suspicious links, unusual attachments, or social engineering cues. Prompt injection avoids these indicators entirely, meaning there are fewer obvious red flags.
In this case, the intention is actually the opposite of user solicitation. The objective is simply for the email to be delivered and remain in the inbox, appearing benign and unremarkable. The malicious element is not something the recipient is expected to engage with, or even notice.
Detection is further complicated by the nature of the prompts themselves. Unlike known malware signatures or consistent phishing patterns, injected prompts can vary widely in structure and wording. This makes simple pattern-matching approaches, such as regex, unreliable. A broad rule set risks generating large numbers of false positives, while a narrow one is unlikely to capture the diversity of possible injections.
How does Darktrace catch these types of attacks?
The Darktrace approach to email security more generally is to look beyond individual indicators and assess context, which also applies here.
For example, our prompt density score identifies clusters of prompt-like language within an email rather than just single occurrences. Instead of treating the presence of a phrase as a blocking signal, the focus is on whether there is an unusual concentration of these patterns in a way that suggests injection. Additional weighting can be applied where there are signs of obfuscation. For example, text that is hidden from the user – such as white font or font size zero – but still readable by AI systems can indicate an attempt to conceal malicious prompts.
This is combined with broader behavioral signals. The same communication context used to detect other threats remains relevant, such as whether the content is unusual for the recipient or deviates from normal patterns.
Ask your email provider about email-delivered AI prompt injection
Prompt injection targets not just employees, but the AI systems they rely on, so security approaches need to account for both.
Though there are clear indications of emerging activity, it remains to be seen how popular prompt injection will be with attackers going forward. Still, considering the potential impact of this attack type, it’s worth checking if this risk has been considered by your email security provider.
Questions to ask your email security provider
What safeguards are in place to prevent emails from influencing AI‑driven workflows over time?
How do you assess email content that’s benign for a human reader, but may carry hidden instructions intended for AI systems?
If an email contains no links, no attachments, and no social engineering cues, what signals would your platform use to identify malicious intent?
![Darktrace’s detection of the unusual external connection to 142.11[.]206[.]73 via port 8000.](https://cdn.prod.website-files.com/626ff4d25aca2edf4325ff97/69fa6d343ee828935a4a00f5_Screenshot%202026-05-05%20at%203.20.33%E2%80%AFPM.png)
