WHEN MFA ISN'T ACTUALLY MFA

Summary from the TLDR Web Dev newsletter

On August 29, 2023, Retool notified 27 cloud customers that there had been unauthorized access to their accounts. Retool had fallen victim to a spear phishing attack two days earlier that took advantage of one of its employees. The hackers took advantage of a Google Authenticator feature that syncs multi-factor authentication codes to the cloud, allowing them full access to the employee’s account.