Tuesday, October 19, 2021

Microsoft 365 OAuth Device Code Flow and Phishing

During a recent red team engagement, we found that the target organization used a well-known identity access management (IAM) product for their multi-factor authentication (MFA) solution. Most of their Internet-facing login portals, such as Office365 and Citrix portals, were behind this IAM platform; however, their users were allowed to enable multiple MFA options, including Email OTP (one-time passcode). Given these situations, we thought a phishing campaign abusing Microsoft 365 OAuth device c…

Read More

Latest news
Related news