TOTP is not enough anymore

TOTP is dead, and most defenders don't know it yet. I'll hijack a fully MFA-protected account live on stage using the same session-stealing phishing kits that attackers use today — then talk about techniques to protect accounts.