Figure’s February 2026 breach exposed 967,200 email records, creating a large operational input that enables credential stuffing, AI-driven phishing, and help-desk social engineering without any exploited vulnerability. Legacy MFA is structurally insufficient against real-time relay (AiTM) attacks and MFA fatigue; true protection requires cryptographic origin binding, hardware-bound keys, and live biometric verification. #Figure #Evilginx
Keypoints
- The Figure breach exposed 967,200 email records that adversaries can immediately weaponize.
- Adversaries run credential stuffing, AI-personalized phishing, and help-desk social engineering in parallel.
- Real-time phishing relay (AiTM) toolkits like Evilginx and Modlishka can bypass push, SMS, and TOTP MFA.
- Phishing-resistant authentication requires origin-bound cryptographic signatures, hardware-bound private keys, and live biometric verification.
- TokenCore’s Biometric Assured Identity enforces hardware-bound keys and live biometrics to eliminate phishing, replay, and delegation risks.