Note! Using MFA does not prevent the phishing per se. MFA is included in all Microsoft 365 and Azure AD subscriptions. This type of phishing can be easily prevented by enabling Multi-Factor Authentication (MFA). Lately some sophisticated phishing sites have checked the entered credentials in real time using authentication APIs. When a victim enters credentials, attackers can use those to log in using victim’s identity. This is the most common phishing technique, where attackers have created login pages that imitate legit login screens. Next I’ll shortly introduce two of the most used techniques related to Microsoft 365 and Azure AD. There are numerous phishing techniques to be used by criminals. Phishing is a cybercrime in which a target or targets are contacted by email, telephone or text message by someone posing as a legitimate institution to lure individuals into providing sensitive data such as personally identifiable information, banking and credit card details, and passwords. I’ll also provide instructions on how to detect usage of compromised credentials and what to do to prevent phishing using the new technique. In this blog, I’ll introduce a new phishing technique based on Azure AD device code authentication flow. The ongoing global phishing campaings againts Microsoft 365 have used various phishing techniques.Ĭurrently attackers are utilising forged login sites and OAuth app consents. “Catching the fish” - victim performs the authentication Phishing with device code authentication.New phishing technique: device code authentication.

Cle de produit office 365