LAPSUS$ Used MFA Fatigue and Social Engineering to Breach Organizations

Microsoft said DEV-0537, also tracked as LAPSUS$ and later Strawberry Tempest, ran a broad campaign of identity-driven intrusions that led to data theft, extortion, and destructive actions against organizations in government, technology, telecom, media, retail, healthcare, manufacturing, energy, and higher education. The group reportedly gained access through stolen credentials, session token replay, MFA fatigue, SIM swapping, help-desk social engineering, and recruiting insiders or suppliers, then moved to reconnaissance, privilege escalation, data exfiltration, and deletion of cloud and on-premises resources. Microsoft also disclosed that the actor accessed a single Microsoft account with limited permissions and viewed some source code, but said no customer code or customer data was affected.

The reporting and Microsoft guidance underscore that push-based MFA abuse was a key part of the actor’s playbook, prompting stronger controls around authentication workflows. Microsoft’s Entra documentation says number matching is now enabled for Authenticator push notifications to replace weaker approve/deny prompts, extending across Entra MFA, self-service password reset, combined registration, and supported AD FS deployments, while older or unsupported environments may still require updates or alternate methods such as TOTP. The company recommended hardening identity protections, restricting access to trusted devices, improving cloud security posture, and preparing incident-response teams for adversaries that may monitor or interfere with response communications.