> series: anatomy_of_a_breach —— part: 159 —— group: lapsus$ —— targets: nvidia_samsung_microsoft_okta —— method: social_engineering_mfa_fatigue —— ages: teenagers<span class="cursor-blink">_</span>_
In early 2022, a cybercrime group calling itself Lapsus$ conducted a stunning series of breaches against some of the world's largest technology companies. Nvidia lost employee credentials and proprietary GPU design data. Samsung lost 190GB of source code including Galaxy device bootloaders. Microsoft lost 37GB of source code for Bing, Cortana, and other projects. And Okta — an identity and access management provider used by thousands of organisations — was accessed through a compromised third-party support contractor, potentially affecting up to 366 Okta customers.
The group's techniques were primarily social rather than technical: bribing or coercing employees and contractors for credentials, SIM-swapping to intercept SMS-based MFA codes, and 'MFA fatigue' attacks — repeatedly sending push notification MFA prompts to targets in the middle of the night until, exhausted, they approved one. UK police arrested a 16-year-old from Oxford and a 17-year-old in connection with the group. The Lapsus$ cases demonstrated that the most damaging breaches of 2022 were achieved not through zero-days or sophisticated exploits, but through human manipulation.
We'll scope your test for free and tell you exactly what you need. No obligation, no hard sell.
Free Scoping CallMFA fatigue — also called 'MFA bombing' or 'push spam' — exploits the weakness of push-notification-based MFA. The attacker, having obtained a valid username and password, repeatedly triggers MFA prompts on the target's phone — at 2am, 3am, 4am — until the target, confused or exhausted, approves one to stop the notifications. The technique bypasses MFA without defeating it technically — it exploits human tolerance instead.
Lapsus$ proved that MFA, while essential, must be implemented correctly to be effective. Push-notification MFA is vulnerable to fatigue attacks; SMS-based MFA is vulnerable to SIM-swapping. Phishing-resistant MFA — FIDO2 hardware tokens, passkeys, and number-matching push notifications — resists these techniques. Cyber Essentials Danzell addresses MFA implementation quality. Our social engineering testing includes MFA bypass assessment. SOC in a Box monitors for MFA fatigue patterns. And UK Cyber Defence provides incident response when social engineering succeeds.
<a href="/cyber-essentials">Cyber Essentials</a> addresses MFA quality. <a href="/penetration-testing/social-engineering">Social engineering testing</a> assesses MFA bypass. <a href="https://www.socinabox.co.uk">SOC in a Box</a> detects MFA fatigue.
We'll scope your test for free and tell you exactly what you need. No obligation, no hard sell.
Free Scoping Call