Hackers can bypass FIDO MFA keys, putting your accounts at risk - here's what we know

A fish hook is lying across a computer keyboard, representing a phishing attack on a computer system.

• A phishing campaign spotted trying to work around FIDO keys
• The "cross-device sign in" feature triggers a QR code
• Crooks can relay the QR code to bypass MFA and log in

Hackers have found a way to steal login credentials even for accounts protected with Fast IDentity Online (FIDO) physical keys. It revolves around a fallback created in these multi-factor authentication (MFA) solutions, and only works in certain scenarios.