I have a question for the hive mind: what is the point of this, exactly?
I mean, I understand the attempt to gain access, and I understand why 2fa codes can be valuable to attempt to phish but that’s like, not the thing here.
They just spam dozens to hundreds of these (I’m showing over 400 in my inbox right now) but like, even if I WANTED to give these codes to the attacker, I have no damn clue who the dude in China that’s doing this is.
I’m confused as to what they hope to gain by trying over and over and over every couple of hours because it feels like there’s no upside to whomever is running this bot, but I probably have missed a memo on some TTP around this, heh.
For the record you should probably change your password. That way they can’t even try.
The thing that I have seen is while it looks like they are after MFA codes, those emails are a distraction from the actual account they are trying to take over, so be very careful when deleting the emails, there could be a legit email in there asking you to roll back an account change.
I’ve been getting these for an account even I can’t get back into.
Gonna have to get real granular with my inbox filters to send them into the void…