how it happened
- whoattackerbought a contractor password
- the gapMFA fatigueone prompt approved
- thenhardcoded admin credsin a script (reported)
- the resultinternal systemsposted in company Slack
what everyone assumed
MFA is treated as the wall that stops a stolen password, and the mental model is a vigilant user tapping approve only for their own logins. The assumption is that the second factor is a decision, made each time by an alert person.
what happened
The prompts kept coming until one was approved, from fatigue or from belief in the IT message, or both. Reporting at the time said that, inside the VPN, the attacker found admin credentials hardcoded in a PowerShell script, which opened Slack, the cloud console and internal tooling. Uber’s own update describes the scope more narrowly.
step by step
- a contractor's password is bought
- MFA prompts keep coming until one is approvedFatigue, an IT message, or both.the assumption breaks here
- a hardcoded admin credential, per reportsSlack, cloud console and internal tools open. Uber describes a narrower scope.
- September 2022the attacker posts in company Slack
how it surfaced
In September 2022 the Lapsus$-linked attacker posted in Uber’s company-wide Slack, having reached internal admin systems. The path ran from a bought contractor password through MFA fatigue to a hardcoded admin credential.
A push prompt is only a control if the person tapping it is alert and certain.
Repeated prompts plus a convincing message turn the second factor into a formality, and a hardcoded admin secret waiting on the far side turns one approval into everything.
picture it at a company like yours
The company here is made up. The other two paths are not: they happened, and each links to the story.
- in this storythe day it mattersAfter many prompts and a fake IT message, one is approved.what it costs youInside, a password saved in a script opens your admin systems.
- or it goes like thisit happenedReddit, 2023howA fake login page passes the password and code to the real site as they are typed.what leavesinternal documents, code and dashboardswho ends up with itthe attacker behind the page
- or it goes like thisit happenedRetool, 2023howA caller posing as IT gets one code, and synced codes unlock the rest.what leavescustomer accounts and fundswho ends up with itthieves
sources
your turn
what you can do about it
this week
Check how your staff approve MFA prompts, and search your scripts for plaintext credentials.
Your MFA is push-based for most accounts, which means it depends on every employee declining every prompt they did not personally start, forever. Somewhere a credential is also sitting in a script in plain text. Both are checkable, and Uber is what happens when neither was.
go deeper
if you're not sure where to start
Run the offboarding checklist on one leaver. It covers every account and token to close when someone leaves.
open the checklist →