NEW DOWNGRADE ATTACK CAN BYPASS FIDO AUTH IN MICROSOFT ENTRA ID

Summary from the TLDR InfoSec newsletter

ProofPoint researchers discovered a new downgrade attack on Entra ID that downgrades the MFA from FIDO to a less secure fallback. The attack uses a custom evilgnix attacker-in-the-middle module to spoof a browser agent that lacks FIDO support, such as Safari for Windows. It can be prevented by disabling fallback methods.