They stole my identity, now 
I am cancelled.

Commissioned by Push Security, exploring the devastating human and operational cost of a cyber compromise for Black Hat Europe 2025, The Sunborn, Royal Victoria Dock, London.

I normally use my passkey to log in, but this time it asked for a code instead. I couldn’t believe it was a phishing site — it looked just like the real login page. It logged me into the website normally too. I had no idea I’d been hacked.

MFA downgrade attack 

40cm x 31cm