Your Phone Is About to Buzz With a Fake Login — Here's What to Do

Full Episode Transcript

A phishing platform called EvilTokens broke into more than three hundred and forty Microsoft companies in just five weeks. And every one of those break-ins happened after the victim typed the right password and approved the right login prompt. The system worked exactly as designed. The attacker still walked away with the keys.

Trusted by Investigators Worldwide

Run Forensic-Grade Comparisons in Seconds

Court-ready facial comparison reports. Results in seconds.

Get Started

7-day refund guarantee**

If you've ever tapped "approve" on a little

If you've ever tapped "approve" on a little notification to log into your email — this story is about you. That tap is becoming the front door to your entire digital life. Right now, the U.S. government is rushing to get rid of passwords entirely. A company called Keytos just partnered with Carahsoft to bring passwordless login to federal agencies. The idea is simple — stop relying on passwords people can steal, and use certificates built into the device instead. It's genuinely more secure. So why are security experts nervous about what comes next?

Let's start with how the attacks actually work today. Security researchers call it MFA prompt bombing. M.F.A. just means multi-factor authentication — that second step where your phone buzzes to confirm it's really you. Attackers send those buzz-confirm prompts over and over again. Dozens of them. Late at night, during dinner, in the middle of a meeting. Eventually someone gets tired and taps "approve" just to make it stop. That's it. The attacker's in. By the middle of 2026, researchers say this is happening to businesses every single week. This article is part of a series — start with Deepfake Sextortion Teens Family Safety Guide.

The reason it works comes down to one design flaw. When that prompt pops up, it tells you almost nothing. It doesn't clearly say where the login is coming from. It doesn't say whether you started it. You're asked to make a security decision with no real information. For thirty years, we trained people to spot bad links and refuse strange downloads. Nobody trained us to question a friendly little "is this you?" pop-up.

Then there's the trickiest attack of all. Security people call it OAuth consent phishing. Picture this. You log in on the real website. You pass the two-step check correctly. Then a screen asks you to grant an app permission to your account. You click "accept." Everything you did was legitimate. But the permission you just handed over goes straight to the attacker. No password was stolen. No security step was broken. That changes how security teams have to think — because their second step already passed. For the rest of us, it means doing everything right can still get you robbed. Previously in this series: Passwordless Identity Government Agencies New Attack Surface.

The Bottom Line

Here's the part that ties it together. The new government systems are built on serious hardware — certificate keys locked inside tamper-resistant chips. Strong stuff. But experts point out that removing passwords doesn't remove the attacker. It just moves them to a new target — you, and the prompts you approve.

The real weak spot was never the password. It's the moment a human says yes. The most dangerous time isn't when passwords are gone — it's the messy in-between, where your work login uses one system and every other app still buzzes your phone the old way. Up next: Your Kids School Photo Is All A Blackmailer Needs Now.

So here's the whole thing in plain terms. The government is dropping passwords for something harder to steal, and that's a real upgrade. But attackers have shifted to tricking people into tapping "approve" and granting permissions they shouldn't. The technology got smarter faster than our habits did. So the next time your phone buzzes asking you to confirm a login you don't remember starting — slow down, and say no. That one pause might be the only thing standing between you and someone else inside your account. The full story's in the description if you want the deep dive.

Your Phone Is About to Buzz With a Fake Login — Here's What to Do