MFA did its job. That is why it failed.

Four of Canada’s largest law firms confirmed breaches in late October 2026: McCarthy Tétrault, Davies Ward Phillips & Vineberg, Bennett Jones and Borden Ladner Gervais. The Globe and Mail named all four. The Globe reported that the way in was a phone call.

The calls often came through Microsoft Teams from what looked like internal IT staff, or by phone from what looked like the IT department’s own number. In some cases, the Globe reported, the caller used Teams to ask for access to an employee’s computer.

McCarthy Tétrault described a “co-ordinated social engineering campaign”, The Logic reported.

Staff who followed the caller were sent to “fraudulent sign-in pages capable of bypassing MFA”, the Globe reported. It wrote that the breaches show “even the largest firms with the most sophisticated technology can’t always ward them off.”

A source told the Globe that the Canadian Centre for Cyber Security’s alert “was indeed spurred by the breaches”. The alert says the campaign it describes is consistent with publicly reported operations by a financially motivated group whose activity has moved from sector to sector throughout 2026.

How the call works

The caller brings a reason that sounds routine. The Cyber Centre’s alert of 28 October lists the usual ones: an urgent passkey migration, a new MFA enrolment or a password change. The Globe reported calls about a critical software update or an expired password.

The caller sounds like the firm. Calls “may spoof legitimate help desk numbers”, the alert says. Callers may reference internal IT staff or a missed deadline. And callers “may end the call if the employee attempts independent verification”.

Then the caller sends the employee to a page. In the alert’s description, it carries the organisation’s name and looks like a page for setting up a new sign-in method. It is a relay: it sits between the employee and the real sign-in service and passes everything along.

1. The password. The employee types it into the relay page. The page enters it on the real sign-in at once.
2. The code. The real sign-in asks for the second factor. The employee gives it, because the request is genuine. The page passes it on.
3. The session. The real service accepts both and issues what a browser keeps to stay signed in. The relay keeps it. The attacker is now signed in as the employee.

The alert puts it in one line: “The page relays credentials and MFA responses to the legitimate identity provider, providing the actor with an authenticated session.”

MFA worked exactly as designed, which is why it failed. The right person answered it on the wrong page.

Once signed in, the alert reports that the group registers sign-in methods of its own, deletes the security notifications and copies data out of Microsoft 365. Then it sends extortion demands.

What stood in public before the first call

A call like this needs something built first. A name has to be registered. A certificate has to be issued for it, or the browser warns the employee. A page has to be served on it. The name, the certificate and the page all exist before any phone rings.

That build is the one part of the attack anyone beyond the firm’s walls can see. Certificates for public websites are published in open logs that anyone can read, as they are issued.

The alert gives the shapes of the names. The targeted firm’s name “may appear as a subdomain of a generic domain” or be built into a newly registered name. Its examples:

• <org-name>.onetimesso[.]com
• <org-name>.registermymfa[.]com
• <org-name>sso[.]com

The words repeat too. The alert lists actions such as activate, enroll and register beside sign-in terms such as passkey, sso and mfa.

The names do not last. The group “frequently rotates lure domains, limiting the effectiveness of blocklists”, the alert says. A list of last week’s names is already behind. The shape is what stays.

One thing is not public. The Globe named the firms and printed no address. The alert printed the shapes and named no firm. Neither source ties a given name to a given firm. Neither does this article.

What the external layer shows and hides

Of the whole attack, only the build lives in public before the call. A reading of the external layer can find a new name that carries a firm’s own name beside one of those sign-in words. It can find it once the name is registered, before anyone dials.

Names of the first kind are harder. The generic root is registered once. The firm’s name is only a label beneath it, so no registration ever carries the firm’s name. It shows only when a certificate names it, unless a wildcard certificate covers it.

Everything after that stays inside the call. No reading of the external layer hears the call or sees the caller ID. It does not see the code as it passes, the session as it is taken or the files as they are copied.

What an early find gives a firm is time. Staff can be told the exact name before the call. The name can be blocked in the firm’s own mail and browsers. A takedown request can go to the registrar. None of that stops a call. It goes after the page the call depends on.

What stops it

The Cyber Centre’s first recommendation is “phishing-resistant MFA, such as FIDO2 security keys, device-bound passkeys”. The reason is mechanical.

A passkey or a security key is tied to the real site’s name. Asked to sign in on a page with any other name, it does not answer. The relay has nothing to pass on. It is a second factor the caller cannot relay.

The alert’s advice, with one rule of our own:

1. A help desk that never asks for a code. Our rule, not the alert’s: the firm’s help desk never asks for a code, an approval or a password on a call. Every employee knows it. A caller who asks is hung up on. The call back goes to a number already on file.
2. Teams closed to other organisations. Messages, calls and meeting invitations from other organisations are limited to the ones the firm needs. A caller who cannot reach Teams loses the most convincing channel.
3. Sign-in from managed devices only. Conditional access that requires a device the firm manages. The relay signs in from the attacker’s own machine, so the real sign-in refuses it.
4. A watch on new names. The alert asks firms to monitor for “newly registered domains impersonating the organization”. Its own examples show which words to watch for.
5. Harder resets. MFA resets, account recovery and new devices get a stronger check, because that is exactly what the caller asks for.

The attack began where nobody was looking

Most protection looks inward: at the accounts, the devices, the network. This attack was built in the external layer, where the first part of it can be read before it is used. The Cyber Centre says it has identified “related infrastructure naming Canadian organizations since January”.

Attackers read businesses with AI. LeakTrace reads them first.