In September 2022, an attacker logged in to a global organization’s network with a contractor’s stolen password, after sending MFA prompts to the contractor’s phone until one was approved. Once inside, the attacker found a PowerShell script on a shared drive. It held the admin login for the system the global organization used to store its privileged passwords. With that login, the attacker reached their cloud accoun
Forbes ·