If you only want to authenticate users that are also "activated", for example, it's as simple as passing an extra argument to Auth::attempt()
.
No need for complex middleware or global scopes.
Auth::attempt( [ ...$request->only('email', 'password'), fn ($query) => $query->whereNotNull('activated_at') ], $this->boolean('remember'));
Tip given by @LukeDowning19