The network for creativity
Join 1.25M professional creatives like you
Connect with clients, get discovered, and run your business 100% commission-free
Creatives on Contra have earned over $150M and we are just getting started
Back to feedPost
Have you wondered how hacekrs bypass MFA? Nowadays it is getting easier. There is a phishing kit called Mirage2FA that has been working against Microsoft 365 since late 2024.
Here is how it goes. The user lands on a fake login page. They type their password. They approve the MFA prompt on their phone. Everything they enter is passed straight through to Microsoft in real time, so the sign-in genuinely succeeds and looks completely normal to them. Microsoft issues the session tokens, and the kit keeps a copy.
With those cookies someone can read the mailbox, open SharePoint and OneDrive, and reach anything sitting behind SSO. They never see a second prompt, because the authentication already happened.
ANY.RUN put numbers on it. 9,426 accounts targeted across 3,518 domains, roughly 4,532 showing signs of compromise, most of them in the US. A third of the successful logins happened on phones, where you can barely see the URL you are looking at.
The advice going around is to switch on Continuous Access Evaluation. I would switch it on too. Just read the documentation first, because it does something slightly different to what people assume.
CAE sessions run tokens for up to 28 hours. The default is one hour. What you get in exchange is revocation when something happens, and Microsoft is specific about what counts: the account is disabled or deleted, the password is changed or reset, MFA gets turned on, an admin revokes refresh tokens, or ID Protection flags the user as high risk. Allow up to 15 minutes for that to propagate. IP location is the only one that applies straight away.
Three things worth knowing before you lean on it. It covers Exchange Online, SharePoint Online and Teams. Guest accounts are not supported, which is where a lot of contractor access lives. And it only reads IP-based named locations, so a country-based policy buys you nothing here.
If I were fixing this in a tenant tomorrow, in this order:
Phishing-resistant sign-in first. A FIDO2 key checks the domain it is talking to, so it will not hand anything over to a proxy wearing Microsoft's face.
CAE on, so revocation actually reaches the services.
Then a runbook where you revoke sessions before you reset the password. Reset first and you have changed the lock while someone is still inside holding a key that works.
If session cookies walked out of your tenant this morning, what would notice, and how long would it take?
Source: ANY.RUN threat research, 19 August 2026. CAE behaviour from Microsoft Learn.
The network for creativity
Join 1.25M professional creatives like you
Connect with clients, get discovered, and run your business 100% commission-free
Creatives on Contra have earned over $150M and we are just getting started
Trending
retrofuturism
Share your favorite designs from the past exploring the distant future. Or your own take on the aesthetic 🚀
halftone
Dots. Texture. Grain. Let's see your designs using the halftone technique.
Midjourney
Creatives are showing off what they're making with Midjourney.
colorgrade
Video editors sound off: How do you enhance the mood of your video in color grading?
Related posts
We kept running into the same problem with Framer:
What if you need a page to be private?
Client work, case studies, unreleased projects, internal pages, sometimes you just need a simple password gate without building an overcomplicated system around it.
So we built Secure Gate.
Enter a password → unlock the page → done.
And the response has been pretty interesting. These are just some of the recent purchases.
It reminded us of something we really believe in: small, highly specific components can be incredibly valuable when they solve a problem people actually have.
That’s exactly what we’re trying to build at our studio, useful tools that solve real problems, not components made just for the sake of having another component.
Absolutely stunning work! Your creativity shines through every detail. Love it
THE HOTEL CHARGED ME ONCE.
BUT IT KEPT SELLING ME THE VALUE OF THAT PURCHASE EVERY SINGLE DAY.
The strangest part? I didn't even realize I was buying Premium.
Most subscription apps do the opposite: sell aggressively before payment, then go silent after it.
On a recent vacation, one thing triggered the booking: a huge private white terrace, right in the room. After intense stretches of work I need silence, privacy, my own space. The terrace hit that need precisely.
Terrace → checklist cleared → booked.
The strange part: the hotel's website doesn't actually sell the Premium layer we experienced. Neither did check-in: praise for the room, nothing about what we'd bought.
Instead, they put bracelets on our wrists. Minimalist, with a small golden crown. Closer to jewelry than to a plastic wristband. No key card at all. The bracelet was the key.
We thought: elegant. Nothing more.
Then it started.
Walk into a restaurant. Scan.
"This is included."
Order something else.
"Also included."
The spa. Included.
Private spa areas nobody mentioned. Available.
Closed-off sections of the hotel. The bracelet opened them.
We paid once. It felt like the hotel kept handing us something new every day.
It took three days to understand: we hadn't booked a room with a terrace. We'd bought A DIFFERENT LAYER OF THE HOTEL. We left without discovering all of it. That's exactly why I want to go back.
This isn't a hotel story. It's a monetization case study.
THE PAYWALL EARNS THE FIRST PAYMENT.
THE PRODUCT HAS TO EARN EVERY RENEWAL.
⚡ I call the alternative PROGRESSIVE VALUE DISCOVERY.
Not hiding features, not vague terms. After conversion, the product keeps revealing already-included value at the moments it becomes relevant. The user keeps thinking: "Oh. This is included too."
PERCEIVED VALUE IS DYNAMIC.
At conversion: Premium = X.
Weeks later: Premium = X + Y + Z + habits + accumulated convenience.
The subscription didn't change. The user's mental model of its value did.
🔴 CONVERSION VALUE ≠ RETENTION VALUE.
Conversion is trigger-driven. Retention is system-driven.
The terrace triggered my purchase. The system created the desire to return.
TRIGGER SOLD. SYSTEM RETAINED.
The bracelet didn't display our status. It changed how the hotel behaved around us. That's the digital version worth building: Premium shouldn't just unlock features. It should change how the product behaves around the user.
VALUE INCLUDED ≠ VALUE EXPERIENCED.
If Premium includes 15 benefits but the user experiences only the one that converted them, their mental model contains one. Not 15.
AFTER SOMEONE SUBSCRIBES, HOW MANY TIMES IN 30 DAYS DOES YOUR PRODUCT MAKE THEM THINK:
"WAIT. THIS IS INCLUDED TOO?"
If the answer is zero, your Premium ends at the moment of payment.
When that's exactly where it should start proving its value.
Next: how I'd build this system. 3 layers, metrics, failure modes.
#MobileAppDesign #ProductStrategy #Monetization #Retention, #AsolDesign
Branding & Hero Animation for Newly.app — AI App Builder
End-to-end branding and hero section design concept for an AI platform that turns ideas into native iOS and Android apps without writing a single line of code.
What we did:
→ Brand Identity: Visual language, color palette, and typography system.
→ Hero Section: Animation concept built around the metaphor of [insert your metaphor, e.g., "ideas transforming into live products"].
→ Motion & UX: Micro-interactions, transitions, and scroll behavior.
The Challenge:
Visually conveying the speed and "magic" of AI while maintaining a professional, tech-forward, and trustworthy image for founders and entrepreneurs.
The Result:
A high-impact hero animation that explains the product's core value proposition in under 3 seconds—capturing the feeling of [insert emotion, e.g., "turning a raw idea into a shipped product with total control"].
Tools: Figma, After Effects, Cinema 4D
Client: Newly
That hero animation is really clean. Love how quickly it shows what the product does.