Two phishing tricks slipping past multifactor authentication, and what your team should do about them.

Our team has handled a wave of these two phishing attempts in local inboxes over the past few weeks. Both are built to get past multi-factor authentication, not just a weak password. Here is how each one works and what to tell your staff today.

1. The Fake Voicemail That Steals Your Microsoft Password

The email looks routine. It says you missed a call and includes a button or attachment to "listen" to the voicemail. The file name often mimics an audio clip, something like a music note next to "New-Voicemail.mp3."

Multi-factor authentication is still worth having, but it is not a guarantee on its own. If a message asks you to sign in to hear a voicemail, review a document or approve a request you did not expect, stop and verify it with your IT team before you click anything.

Biz Technology Solutions provides managed cybersecurity services powered by a 24/7 Security Operations Center staffed with cybersecurity professionals. If you would like a second set of eyes on what is reaching your users' inboxes, get in touch.