CloudFit

United States – October 20, 2026 -- CloudFit said the Department of War's pause on parts of the CMMC rollout does not change cybersecurity obligations for the more than 220,000 organizations in the Defense Industrial Base (DIB) that are entrusted with protecting Controlled Unclassified Information (CUI).

CloudFit says DFARS and NIST requirements remain in force

The company said the implementation timeline for portions of CMMC may be changing, but obligations to safeguard sensitive information under DFARS and NIST requirements have not been paused. It added that cyber threats have not paused either.

Cost and complexity block adoption across the DIB

CloudFit argues that compliance mandates alone will not secure the DIB. It says many companies have had to choose between expensive custom implementations, delaying security investments, or attempting compliance on their own. In its view, that model does not scale to the size of the DIB.

Global – October 20, 2026 -- Attackers are now capturing valid multi-factor authentication (MFA) codes in real time, so a single phishing click can give them full account access and a path into an entire organization, according to Chris Bentkowski, Service Engineer at CloudFit.

Fake login pages harvest passwords and live MFA codes

The typical attack starts when a user clicks a malicious link and lands on a fake login page that mimics a trusted application. The user enters a username and password, then a valid code from an authentication app. The attacker can then complete authentication, capture session details and potentially reconfigure or take control of MFA mechanisms. Bentkowski calls the technique MFA phishing, or token/session capture.