Activity timeline
T1556.006 first appeared in tracked threats on and was most recently reported on . The busiest month was 2026-07 with 6 reports, and 22 of the 22 threats were reported in the twelve months to 2026-09.
How adversaries use it
T1556.006 Multi-Factor Authentication is catalogued by MITRE ATT&CK under the Persistence and Defense Impairment and Credential Access tactics in the Enterprise matrix, as a sub-technique of T1556 Modify Authentication Process. Threadlinqs maps 22 of 2623 tracked threats (0.8%) to it; by severity that is 7 critical, 15 high.
Threats that use T1556.006 most often also use T1078.004 Cloud Accounts (15 threats), T1528 Steal Application Access Token (13 threats), T1539 Steal Web Session Cookie (11 threats), T1657 Financial Theft (11 threats), T1199 Trusted Relationship (9 threats). These are the techniques an intrusion set tends to chain with it, so they are the natural next places to look when it is observed.
18 tracked threat actors appear in the threats that use T1556.006; the most frequent are Scattered Spider (4), ShinyHunters (3), APT28 (1), Bling Libra (1), BlueDelta (1).
Mitigations
MITRE ATT&CK lists 3 mitigations for T1556.006.
Data sources
Telemetry that can reveal T1556.006, per MITRE ATT&CK.
- Active Directory — Active Directory Object Modification
- Application Log — Application Log Content
- Logon Session — Logon Session Creation
- User Account — User Account Authentication, User Account Modification
Threat actors using it
Tracked threats
22 tracked threats use T1556.006.
- Passkey-Themed Help Desk Phishing Hijacks Microsoft 365 Cloud Accounts for Data Exfiltrationhigh
- BigBear 2.0 Evilginx2 Phishing-as-a-Service Campaign Targeting Microsoft 365 with MFA Bypasscritical
- ZeroBytes Breaches French Tax Authority (DGFiP): Stolen Credentials and MFA Bypass Expose Tax Data of…high
- Payroll Pirates (Storm-2755) Abuse Microsoft Graph for HR/Finance Staff Recon After AiTM Account Compromisehigh
- Malware Abuses Windows Hello for Business Key to Authenticate to Microsoft Entra IDhigh
- Unit 42: Identity Compromise Is the Primary Attack Vector in Nearly 90% of Incidentshigh
- Greatness PhaaS Platform Spoofs RingCentral in Adversary-in-the-Middle and Device Code Phishing Campaign…high
- Pass-ta-key: Novel Attack Surface in Google Password Manager Synced Passkey Authenticationcritical
- Operation RoundPress: TA458 Deploys SpyPress Malware via Half-Click Webmail Zero-Days (CVE-2025-27915…critical
- "The Procurement Trap": AiTM Phishing-as-a-Service Campaign (EvilProxy, FlowerStorm/Storm-1167, Kali365)…high
- Two Scattered Spider Leaders Jailed for £29M Transport for London (TfL) Cyberattackhigh
- Check Point 2026 AI Security Report: Autonomous AI-Driven Exploitation, CLAUDE.md Jailbreaking, and…high
- Forg365 Phishing-as-a-Service Platform Uses AI-Generated Lures and AiTM/Device-Code Phishing to Compromise…high
- BeyondTrust Microsoft Vulnerabilities Report 2026: Critical Flaws More Than Double as Elevation of Privilege…high
- Zscaler ThreatLabz 2026 Report: Encrypted Phishing & AiTM/BiTM Initial-Access Campaigns Targeting the Public…high
- Dashlane Device-Registration API 2FA OTP Brute-Force Campaign — Encrypted Vaults of <20 Personal-Plan…high
- Kali365 PhaaS — Telegram-Distributed Microsoft 365 Device-Code Phishing with OAuth Token Theft & MFA Bypass…high
- Storm-2949 Cloud-Wide Breach — SSPR Abuse & Azure RBAC Lateral Movement to Mass Data Exfiltrationcritical
- Sorry Ransomware Mass Exploitation of cPanel/WHM Authentication Bypass CVE-2026-41940 (44,000+ Servers…critical
- Zimbra Collaboration Suite Stored XSS via CSS @import Active Exploitation (CVE-2025-66376) — Operation…critical
- ShinyHunters Evolves TTPs: Vishing and Login Harvesting for SSO/MFA Bypasshigh
- Swiss NCSC/NTC Pilot Project Discloses Multiple Vulnerabilities in TYPO3 CMS and QGIS/QWC2 (CVE-2025-30083…critical
Detection coverage
Threadlinqs maintains 50 detection rules mapped to T1556.006 (SPL 19, KQL 14, Sigma 17). Rule content is available to Blue tier accounts and above; this page shows counts only.
Parent technique
T1556 Modify Authentication Process — 147 tracked threats at the technique level.