IntegrAuth Academy
Identity, security and practical AI — free, from zero. Byte-sized lessons, real diagrams, hands-on labs, zero fluff. Two programs, each with its own exam and certificate.
English is hard? Your browser can translate this page into Tamil, Telugu, Kannada, Malayalam or Hindi. Tech words stay in English so you learn the real names.
How?
- Chrome on phone: ⋮ menu → Translate
- Chrome on computer: right-click → Translate to …
- Edge: the translate icon in the address bar
The big picture
The other tracks built the locks. This one showed how each lock gets picked, so you can spot the attempt and shut the door. Here is the whole tour in one page.
The story you just lived
- Front door. Bots try leaked and common passwords thousands of times an hour. That is credential stuffing and password spraying. A lockout cannot see it. Layers stop it: MFA or a passkey, a breached-password check, bot signals and alerts across accounts.
- Fake login page. Maya types her password and code into a perfect copy. Both are passed on live. This is adversary-in-the-middle. Only an origin-bound passkey survives it.
- Approval prompts. Priya's phone buzzes all night until one sleepy tap says yes. This is MFA fatigue. A number-match gate stops it, because there is no button to tap blindly.
- A real code. Sam is nudged to type a real code at his real provider. This is device-code phishing. One question stops it: did I start this?
- A rogue app. Priya taps "Allow" and gives a refresh token that can outlive a password reset. This is consent phishing. Make broad grants an admin's decision.
- The cookie. Maya's session cookie is a bearer token that anyone can replay. Session hijacking is beaten by binding the cookie to her device and by spotting it on another.
- The back door. A call to the carrier moves her number, and every text code follows. A call to the help desk resets her MFA (fake help-desk calls). This is attacking the recovery path. Raise every reset route to the same bar as the login. Give the help desk rules that no voice can bend.
- The safety net. Detection engineering turns logs into tripwires. The tabletop rehearses the response: contain before you clean, and hunt the persistence a password reset leaves behind.
The threads that tie it together
Shared secrets fall; bound proofs stand
Anything you can copy and replay will end up in the wrong hands. That includes a password, a one-time code and a cookie. Proofs tied to an origin or a device fail against adversary-in-the-middle and session hijacking.
Attackers take the weakest route
A strong front door is wasted if a side door is weak. Consent phishing skips the password. SIM swap attacks recovery. Raise every route to the same height.
The tell is a prompt you did not start
MFA fatigue and device-code phishing both fall apart when you ask "did I start this?" before you approve.
Prevention leaks; detection is the net
Assume some attack lands. Detection engineering catches it. The tabletop turns the catch into a calm response.
Knowing how each attack works makes you a faster, calmer defender. You stop trusting the padlock. You raise the weakest door, not the strongest.
Go deeper: Where these attacks sit in MITRE ATT&CK
The MITRE ATT&CK catalog gives every attacker technique an ID. Use the IDs to search for detections and reports. The IDs below were checked against the catalog in October 2026.
| Attack in this track | ATT&CK technique |
|---|---|
| Session cookie theft, including by a phishing proxy | T1539 Steal Web Session Cookie. T1557 Adversary-in-the-Middle is the general technique, and its listed examples include phishing proxies. |
| MFA fatigue | T1621 Multi-Factor Authentication Request Generation |
| Consent phishing and stolen OAuth tokens (device-code phishing ends the same way) | T1528 Steal Application Access Token |
| SIM swap | T1451 SIM Card Swap (mobile matrix) |
| Credential stuffing and password spraying (bots at the front door) | T1110.004 Credential Stuffing, T1110.003 Password Spraying |
Where to go next
Every attack here pointed to the same cure. Adopt the phishing-proof answer in Passkeys & WebAuthn. Make a stolen token worthless with device binding. Give responders the access they need with break-glass accounts.
Ready to show you can tell an attack from noise? The cheat sheet & pop quiz is one page on.