User Scammed/Hacked past random pwd and SMS MFA

[Ahhzz]

I ran into this, and I'm looking to make sure exactly how the process broke. Can I get some input/feedback?
Client sent an email, appeared to be typical "Looks like our user, requested a change of banking info, please investigate". I scrolled down the email, and the address looked legit; decent spoof, I'll check headers. But first, go for the obvious: user sent it.
TAP to the sent box, nothing there, hit the deleted, nothing there, go to the "recovery", and there it is. "Oh crap, did they manage to get MFA disabled??!!" Blocked sign-in, revoked authenticators and sessions, changed the password. Called the user, and discussed while I went digging, and while in discussion, user reported they had "had to use their password earlier this week, or a few days ago", but couldn't remember where or why. Great.
Called management, explained the steps so far, and received permission to investigate and re-enable with extra reinforcement for phishing attacks. (after the discussion, I'm pretty sure the user won't put their password in *anywhere* for at least three months without calling me first).
After prompting and digging, determined the following:

• User had some junkware "Driver Updater" on laptop used at home over the weekend, was removed without verifying possibility of attack vector
• Password is a randomly generated >12 character mess: no dictionary words or leet speek
• Password is saved in Edge on "home" laptop for checking email
• Received a MFA SMS Monday afternoon, 1st day of account compromise, but user didn't see it/know it/request it
• Entra shows access from approx 2500 miles away near the opposite coast starting that day
• Client is a large company, multi-national, but not infra-structure critical, not F500, and the targeted user was a low-level employee in accounting: very little ability to change much, and the spoofed email request was out of the ordinary enough to prompt a phone call. in other words, neither the client nor the user were whale targets
• User is not a disgruntled employee, just a little absent minded, but not enough to not remember someone else asking for an MFA code... I think....
• None of the users for the company display the level of skill required to clone a phone, and absolutely none in the immediate physical area of the user have that skill level, and again: weak target, small fish
• Entra sign-in indicates
  • Authentication requirement Multifactor authentication
  • MFA requirement satisfied by claim in the token

Assuming either the user entered their password on a site I couldn't find in history, or it was scavenged from the browser remotely somehow, how would someone get past the MFA? and wth does the log mean : "requirement satisfied by the token"?
thanks!

 

[Chrispy_]

It broke because SMS isn't a valid 2FA and hasn't been for 4-5 years.

SMS is unencrypted and just about anyone with motivation can gain access to SMS data using freely-available toolkits that your average bad actor will have at their disposal.

I've been enforcing biometric 2FA for almost two years now, and I feel I was lucky that nobody using SMS had their account compromised before that!

The biggest shock to me is that Azure/Entra still allows SMS as an authentication method

 

[natr0n]

If I had to guess the hacker source might be from Indonesia. They are doing things like this lately.