Nowadays, most companies enforce MFA (Multi-Factor Authentication) for initial and persistent authentication. Some companies claim to be secure once MFA is configured on all (non-service) accounts. However, this Uber hack proves cloud-based MFA push notifications can be abused, even when conditional access is configured. This article explains how to detect this attack: https://cryptsus.com/blog/azure-mfa-bombing-detection-sentin...