Most Popular Detection – Vishing/Rogue MFA Takeover/Helpdesk-Support Impersonation 2026: Helpdesk Downgrade from FIDO2/Passkey to SMS/Voice/TOTP MFA
Detects a suspicious sequence of administrative actions where a user's phishing-resistant multi-factor authentication (MFA) factor, such as FIDO2, passkeys, or certificates, is removed and immediately replaced by a weaker authentication method like SMS, voice call, or TOTP. This behavior, when performed by an administrator account on a different user account, is a common indicator of an MFA bypass attempt often associated with social engineering or insider threat scenarios.
YARA-L
