'%3e%3c/ellipse%3e%3cpath%20d='M20.5%2023.5%20L3.4%2045.6%20L23%2031.8%20Z'%20fill='%23B4EE3A'%20stroke='%23B4EE3A'%20stroke-width='3'%20stroke-linejoin='round'%20stroke-linecap='round'%3e%3c/path%3e%3cpath%20d='M47%2020.5%20Q42%2033%2030.5%2036.5'%20stroke='%23FFFFFF'%20stroke-opacity='0.35'%20stroke-width='2.4'%20fill='none'%20stroke-linecap='round'%3e%3c/path%3e%3ccircle%20cx='30.2'%20cy='20.2'%20r='4.4'%20fill='%23FFFFFF'%3e%3c/circle%3e%3ccircle%20cx='28.9'%20cy='20.4'%20r='2.15'%20fill='%23101116'%3e%3c/circle%3e%3ccircle%20cx='27.9'%20cy='19.1'%20r='0.85'%20fill='%23FFFFFF'%3e%3c/circle%3e%3c/svg%3e)
Why this matters
They already have the password
0% complete · 8 min · Core · Written lesson · Free under CC-BY-4.0
CISA AA23-320A (Scattered Spider): push bombing is a documented social-engineering path to a session. Number matching exists because a blind Approve is exploitable UX.
CISA: phishing-resistant MFA (FIDO/WebAuthn) is the destination; number matching is the interim if you still live on push.
Your progress stays in this browser. It is never sent to us. No account, no email, no analytics on these pages.
Reviewed and signed off by
Peer review pending - no reviewer has been recorded for this module yet.