Yubikey

$900 malware makes MFA useless—and anyone can buy it

Storm-0558’s $900/month malware kit turns session cookies into skeleton keys for enterprise and crypto accounts—no phishing or MFA prompts required.