Attackers used fake Microsoft sign-in pages and device-code phishing to capture or obtain authenticated Microsoft 365 sessions, bypassing the need to repeat multi-factor authentication. They then took over accounts, added their own devices and authentication methods, and hid messages with inbox rules, sometimes within minutes of the victim authenticating.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
That Microsoft login can steal your session, even after MFA. A fake page says, ‘Sign in to your Microsoft 365 account to continue.’ It relays your password and MFA to Microsoft, then captures the signed-in session. The giveaway? An unexpected address or MFA prompt. Device-code phishing can even use Microsoft’s real site: a code you didn’t request approves someone else’s session. In this campaign, stolen sessions reached 79 organizations. Didn’t start the sign-in yourself? Stop, don’t approve it.
Attackers used fake Microsoft sign-in pages and device-code tricks to steal completed Microsoft 365 login sessions, then replayed those sessions without needing passwords or new MFA approvals. After entering accounts, they registered rogue devices, replaced MFA methods, and hid mailbox messages,…
Attackers used fake Microsoft sign-in pages to capture already-authenticated Microsoft 365 sessions, then replayed those sessions to enter business accounts without passwords or new MFA prompts. The campaign affected 79 organizations and expanded access by registering rogue devices, changing MFA…
Attackers are using real OAuth sign-in and consent flows to steal access tokens or trick users into authorizing malicious apps. Because the victim signs in through a legitimate identity provider and completes MFA, attackers can gain durable access that may survive password resets. The article…
Cofense analyzed real phishing emails disguised as bidding invitations. The emails send recipients to fake, branded login and device-enrollment pages, then trick them into entering a device code in a genuine Microsoft prompt. Doing so can authorize an attacker’s session without giving them the…
The report documents how criminals use antidetect browsers to make stolen sessions and phishing logins appear to come from legitimate, local devices. A commercially available Browser-in-the-Middle workflow can relay a victim’s login details to real services such as Google, Microsoft, Facebook, and…
Threat actors are hijacking existing email conversations, or patiently starting new ones, to build trust before sending a malicious reply. The final message commonly poses as a meeting invitation, secure message, shared file, or important document and leads to credential theft or remote-access…
