The attack dominating financial services doesn't steal passwords. It resets MFA and steals the token.

The most active attacker in the financial services sector over the past year employed voice phishing tactics to manipulate employees into resetting their multi-factor authentication (MFA), allowing them to bypass traditional security measures and gain unauthorized access to networks. Reports indicate a significant increase in such attacks, highlighting a shift in cyber threats from credential theft to exploiting legitimate authentication flows and social engineering techniques.