{"id":4010,"date":"2026-01-07T12:39:32","date_gmt":"2026-01-07T12:39:32","guid":{"rendered":"https:\/\/ft365.org\/index.php\/2026\/01\/07\/mfa-failure-enables-infostealer-breach-at-50-enterprises\/"},"modified":"2026-01-07T12:39:32","modified_gmt":"2026-01-07T12:39:32","slug":"mfa-failure-enables-infostealer-breach-at-50-enterprises","status":"publish","type":"post","link":"https:\/\/ft365.org\/index.php\/2026\/01\/07\/mfa-failure-enables-infostealer-breach-at-50-enterprises\/","title":{"rendered":"MFA Failure Enables Infostealer Breach At 50 Enterprises"},"content":{"rendered":"
\n

\"Photo<\/p>\n<\/div>\n

\n
\n

Dozens of global organizations have had highly sensitive corporate and customer information stolen and put up for sale by a threat actor because they didn\u2019t secure cloud systems with multi-factor authentication (MFA), a new report has revealed.<\/p>\n

The actor, known as \u201cZestix\u201d (aka \u201cSentap\u201d) scoured the dark web for infostealer logs containing credentials for popular cloud file sharing services ShareFile, Nextcloud\u00a0and OwnCloud, according to Hudson Rock.<\/p>\n

He was subsequently able to access, exfiltrate and auction the data stored in these accounts, due to a lack of MFA, the cybersecurity vendor said.<\/p>\n

\u201cA critical finding in this investigation is the latency of the threat. While some credentials were harvested from recently infected machines, others had been sitting in logs for years, waiting for an actor like Zestix to exploit them,\u201d Hudson Rock explained.<\/p>\n

\u201cThis highlights a pervasive failure in credential hygiene; passwords were not rotated, and sessions were never invalidated, turning a years-old infection into a present-day catastrophe.\u201d<\/p>\n

Read more on infostealers: Staggering 800% Rise in Infostealer Credential Theft<\/em><\/p>\n

The credentials were originally obtained via a number of infostealer variants, including RedLine, Lumma and Vidar.<\/p>\n

\u201cBecause the organizations [\u2026] did not enforce MFA, the attacker walks right in through the front door. No exploits, no cookies \u2013 just a password,\u201d noted Hudson Rock.<\/p>\n

The financially motivated threat actor apparently appears to be comfortable interacting on closed Russian cybercrime forums, where he presents as an initial access broker (IAB). However, the Sentap persona has also been linked to an Iranian national\u00a0and is affiliated with the Funksec cybercrime group, the report claimed.<\/p>\n

A Roll Call of Victims<\/h2>\n

Among the organizations caught out by Zestix and named in the report are:<\/p>\n