LACK OF MFA IS COMMON THREAD IN VAST CLOUD CREDENTIAL HEIST

Summary from the TLDR InfoSec newsletter

A threat actor called Zestix used common infostealers like RedLine, Lumma, and Vidar to harvest long-lived credentials from infected machines and log dumps, then logged into corporate ShareFile, OwnCloud, and Nextcloud instances that lacked MFA.