- Ledger Lowdown
- Posts
- Hackers found the MFA loophole
Hackers found the MFA loophole
just added the borders
I share the 4-5 most important accounting that actually matter. I scroll so you don’t have to.
So grab your coffee, take a quick break, and lets catch up.
Today’s Ledger:
Hackers found the MFA loophole.
The SALT cap survives court.
Monopoly is still stuck in movie jail.
WTF of the Day🤯
Hackers found the MFA loophole
Accounting firms did the right thing. They added MFA, which means employees need more than a password to log in. They trained staff. They tightened access. Now hackers found a way around it.
The attack is called device code phishing. It abuses a real Microsoft 365 login feature made for devices like smart TVs and conference room systems. The hacker creates a real Microsoft device code, then sends an email that looks like a tax file, client document, or HR record. The employee goes to Microsoft’s real login page, enters the code, completes MFA, and thinks they did the safe thing. But the login token goes to the attacker.
That can give hackers access to email, shared drives, client portals. The fix is not just more “watch for bad links” training, because there may be no fake link. Firms should audit third-party app access, check sign-in logs, look for hidden email forwarding rules, and tell staff one simple rule, never enter a Microsoft code unless you started the login yourself.
What’s poppin in accounting🍿
The SALT cap is not going away
The SALT cap is the limit on how much state and local tax someone can deduct on their federal return. Before 2018, itemizers could deduct all of it. Then the TCJA capped it at $10,000, which hit people in high-tax states hard.
Some taxpayers were hoping the courts would kill the cap. That did not happen. A New Jersey district court just dismissed a case arguing the cap was unconstitutional, after another court already rejected a similar challenge from New York. So if clients were waiting for judges to bring back the full deduction, that door looks pretty shut.
There is still some relief. The new tax law raises the cap to $40,000 starting in 2025, then bumps it up 1% each year through 2029 before it falls back to $10,000 in 2030. But higher earners can lose part of that benefit once income passes $500,000. For business-owner clients, the better move may be a pass-through workaround if their state allows it. The courts are not saving this deduction, so planning has to.
Weekly Trend Chart 📊
Monopoly Is America's Top Board Game
Lionsgate has been trying to turn Monopoly into a movie for more than 10 years. Somehow, the little metal top hat is still not ready for Hollywood.
The studio is now using two different writing teams to work on separate versions of the film. One team worked on Dumb Money. The other worked on A Minecraft Movie. Lionsgate also locked up the Monopoly rights through a Hasbro deal and brought in Margot Robbie’s LuckyChap after Barbie proved that toy brands can still print money at the box office.
The problem is obvious. Everyone knows Monopoly, but nobody knows what the movie is supposed to be. A family comedy? A business satire? A rich guy origin story for Mr. Monopoly? The board game has reach. Only 5% of U.S. adults say they have never played it. But Hollywood has been burned by game movies before. Battleship cost a fortune and opened weak. So Lionsgate has the brand. Now it needs the part that actually matters. A reason to watch.
Meme of the Day😂
😂