NCERT Warns of Sharp Surge in 2FA Bypass Cyberattacks Targeting Cloud Platforms

ISLAMABAD: The National Computer Emergency Response Team (NCERT) has issued a security advisory highlighting a sharp spike in 2FA bypass cyberattacks targeting Gmail, Microsoft 365, and other cloud-based services widely used by businesses and institutions.

According to the alert, attackers are using sophisticated phishing tactics, including fake login portals, to steal credentials and one-time passwords (OTPs), thereby undermining two-factor authentication systems and exposing users to increased risks of data breaches.

NCERT reports a staggering 1800% increase in SVG-based phishing campaigns in 2025. These threats exploit HTML5 CAPTCHA forms and embed malicious scripts that deceive users into handing over sensitive login data. The growing complexity of these methods makes them a serious threat to corporate emails, file systems, and internal networks across public and private organizations.

The scope of 2FA bypass cyberattacks has extended beyond Gmail and Microsoft 365, now targeting essential platforms like Google Workspace, OneDrive, and SharePoint. These services are crucial to daily operations, making them high-value targets for cybercriminals seeking to exfiltrate data or disrupt enterprise workflows.

In response, NCERT has instructed institutions to immediately audit their authentication systems, apply all relevant security patches, and initiate red team simulations focused on identifying weaknesses in 2FA setups. Additional recommendations include enforcing strict access controls and monitoring for unauthorized logins.

Users are strongly advised to access services only via official URLs and avoid email links that could redirect them to phishing sites. NCERT underscores the importance of regular cybersecurity training, increased vigilance, and real-time monitoring to counter this rapidly evolving threat landscape.