Hackers can bypass Your MFA In 2026 (And How To Stop It)

Comments · 250

• DA

  @davidbombal · 6 months ago · pinned

  Thank you to ThreatLocker for sponsoring my trip to ZTW26 and also for sponsoring this video. To start your free trial with ThreatLocker please use the following link: &nbsp;<a href="https://www.threatlocker.com/davidbombal">https://www.threatlocker.com/davidbombal</a><br><br>Are your passwords and 2FA enough to stop a modern cyber attack? In this interview, Rob from<br>ThreatLocker breaks down the dangerous reality of password reuse, SIM swapping, and why<br>traditional SMS MFA is no longer bulletproof.<br><br>We dive deep into how threat actors use reverse proxies like Evilginx to steal session cookies, allowing them to bypass multi-factor authentication and hijack your accounts without ever needing your password.<br><br>Discover why relying on legacy VPNs and leaving firewall ports open to the internet massively<br>increases your attack surface, leaving your organization just one brute-force attack away from<br>ransomware. Finally, we explore the mechanics of ThreatLocker’s Zero Trust Network Access<br>and Cloud Access, detailing how denying by default and routing through secure proxies can lock<br>down Microsoft 365 and make your internal network effectively invisible to hackers.<br><br>// Rob Allen’s SOCIAL //<br>LinkedIn: &nbsp;<a href="https://www.linkedin.com/in/threatlockerrob/">https://www.linkedin.com/in/threatlockerrob/</a><br>X: &nbsp;<a href="https://x.com/threatlockerrob">https://x.com/threatlockerrob</a><br><br>// David&apos;s SOCIAL // <br>Discord: <a href="https://discord.com/invite/usKSyzb">https://discord.com/invite/usKSyzb</a> <br>X: <a href="https://www.twitter.com/davidbombal">https://www.twitter.com/davidbombal</a> <br>Instagram: <a href="https://www.instagram.com/davidbombal">https://www.instagram.com/davidbombal</a> <br>LinkedIn: <a href="https://www.linkedin.com/in/davidbombal">https://www.linkedin.com/in/davidbombal</a> <br>Facebook: <a href="https://www.facebook.com/davidbombal.co">https://www.facebook.com/davidbombal.co</a> <br>TikTok: <a href="http://tiktok.com/@davidbombal">http://tiktok.com/@davidbombal</a> <br>YouTube: <a href="https://www.youtube.com/@davidbombal">https://www.youtube.com/@davidbombal</a><br>Spotify: &nbsp;<a href="https://open.spotify.com/show/3f6k6gERfuriI96efWWLQQ">https://open.spotify.com/show/3f6k6gERfuriI96efWWLQQ</a><br>SoundCloud: &nbsp;<a href="https://soundcloud.com/davidbombal">https://soundcloud.com/davidbombal</a><br>Apple Podcast: &nbsp;<a href="https://podcasts.apple.com/us/podcast/david-bombal/id1466865532">https://podcasts.apple.com/us/podcast/david-bombal/id1466865532</a><br><br>// MY STUFF //<br> <a href="https://www.amazon.com/shop/davidbombal">https://www.amazon.com/shop/davidbombal</a> <br><br>// SPONSORS // <br>Interested in sponsoring my videos? Reach out to my team here: sponsors@<a href="http://davidbombal.com/">davidbombal.com</a><br><br><br>// MENU //<br><a href="https://www.youtube.com/watch?v=b_KDCLBVng0">0:00</a> - Coming up<br><a href="https://www.youtube.com/watch?v=b_KDCLBVng0&amp;t=57">0:57</a> - What is 2FA/MFA and why is it important?<br><a href="https://www.youtube.com/watch?v=b_KDCLBVng0&amp;t=174">02:54</a> - Reusing passwords<br><a href="https://www.youtube.com/watch?v=b_KDCLBVng0&amp;t=278">04:38</a> - Malicious Chrome extensions<br><a href="https://www.youtube.com/watch?v=b_KDCLBVng0&amp;t=339">05:39</a> - Average person vs cybersecurity<br><a href="https://www.youtube.com/watch?v=b_KDCLBVng0&amp;t=738">12:18</a> - SMS 2FA<br><a href="https://www.youtube.com/watch?v=b_KDCLBVng0&amp;t=817">13:37</a> - Authenticator apps<br><a href="https://www.youtube.com/watch?v=b_KDCLBVng0&amp;t=986">16:26</a> - Yubikeys<br><a href="https://www.youtube.com/watch?v=b_KDCLBVng0&amp;t=1078">17:58</a> - No one is &quot;unhackable&quot;<br><a href="https://www.youtube.com/watch?v=b_KDCLBVng0&amp;t=1312">21:52</a> - &quot;Cookie stealing&quot; explained<br><a href="https://www.youtube.com/watch?v=b_KDCLBVng0&amp;t=1373">22:53</a> - ThrearLocker&apos;s new tool/solution<br><a href="https://www.youtube.com/watch?v=b_KDCLBVng0&amp;t=1702">28:22</a> - How ThreatLocker protects Office365<br><a href="https://www.youtube.com/watch?v=b_KDCLBVng0&amp;t=1746">29:06</a> - ThreatLocker protecting organizations<br><a href="https://www.youtube.com/watch?v=b_KDCLBVng0&amp;t=1991">33:11</a> - Should I trust ThreatLocker?<br><a href="https://www.youtube.com/watch?v=b_KDCLBVng0&amp;t=2154">35:54</a> - How safe is ThreatLocker?<br><a href="https://www.youtube.com/watch?v=b_KDCLBVng0&amp;t=2280">38:00</a> - Conclusion<br><br>Please note that links listed may be affiliate links and provide me with a small percentage/kickback should you use them to purchase any of the items listed or recommended. Thank you for supporting me and this channel! <br><br>Disclaimer: This video is for educational purposes only.<br><br><a href="https://www.youtube.com/hashtag/cybersecurity">#cybersecurity</a> <a href="https://www.youtube.com/hashtag/hacker">#hacker</a> <a href="https://www.youtube.com/hashtag/hack">#hack</a>

  9

• MI

  @michaelwills1926 · 6 months ago

  Been in tech for 27 years and at this point I’m good if the whole thing collapsed to the ground and started over with slide rulers

  99

• CR

  @Crux161 · 6 months ago

  This is old news by a number of years, but thanks for freaking me out before I’ve had my coffee 🤦‍♂️

  31

• GH

  @Ghazkul666 · 6 months ago

  BTW for really important accounts like PayPal etc. I do store them in bitwarden BUT I add some extra characters that I remember to the password. Tip is it doesn&apos;t have to be at the end of the password field. It can be anywhere! And then make sure that bitwarden doesn&apos;t ask to &nbsp;save that password on that site ever again

  17

• UR

  @UrAdversary · 6 months ago

  Password managers are great! For critical accounts I like to store my randomly generated passwords then add pepper on top (which isn&apos;t stored in my password manager). This is another layer of security, something that only I know (memorized and not written down anywhere).<br><br>It does make it so I can only auto fill partially, but it&apos;s a trade off of convenience for security.

  30

• TH

  @The.Anonymous.Anonymous · 6 months ago

  Years ago I memorized almost 200 complex passwords and serial numbers. When I started using passwords managers and randomly generated ones, my brain forgot almost everything in a instant 😂😂😂 I only remember a few serial numbers.

  12

• BA

  @bassman87 · 6 months ago

  Microsoft Authenticator chalenging a random number is a nice feature to fight MFA bombing. &nbsp;Im surprised more autheticator apps havent adopted that feature.

  6

• PR

  @PracticalPreparedness-n4u · 6 months ago

  Many companies are taking their 2FA system and making it a 1FA system. They don’t ask for my password anymore they just send me a code. <br>I hate this. Now if someone clones my phone they can get into those accounts. <br><br>It’s annoying that corporations are not taking this seriously

  9

• BB

  @bbowling619 · 5 months ago

  He meant to say we block everything . Good luck getting any work done!

  2

• BR

  @brianbrian5842 · 6 months ago

  If these&quot;zero trust&quot; providers get compromised or enforced to comply by a government is going to be wild. <br><br>This new model places many gems in one place.

  11

• JO

  @joshuaa3075 · 6 months ago

  Password managers can help. Money conscious, can use a free version of Bit Warden. As they mentioned in this interview, use strong passwords that are not reused. The master password of a password manager should not be written down, protect that one so it cannot be guessed.

  24

• 42

  @42Journeyman · 6 months ago

  The Yubikey security series has a pin option and is 1/3 the price of a biometric key. Firefox has containers which also helps mitigate session cookie stealing.

  7