Phishing Attack Bypassed Office 365 Multifactor Protections

guest · May 20, 2020

Phishing Attack Bypassed Office 365 Multifactor Protections
May 20, 2020
https://www.inforisktoday.com/phishing-attack-bypassed-office-365-multifactor-protections-a-14310

A recent phishing campaign bypassed multifactor authentication protections within Microsoft Office 365 to steal users' credentials stored in the cloud or launch other attacks, according to the security firm Cofense.

Unlike a typical phishing attack that attempts to harvest credentials by having a user input their username and password into a malicious domain designed to look like a Microsoft application, this campaign attempted to trick the victim into granting permission for a rogue application to run on their device, Cofense says in a new report. This helped bypass the multifactor authentication process.

This phishing campaign leveraged the OAuth2 framework and the OpenID Connect protocol, which help authenticate users of Office 365, along with a malicious SharePoint link designed to trick a victim into granting permission to a rogue application that the hackers control, according to Cofense.

"The phish is not a typical credential harvester, and even if it was, multifactor authentication wouldn't have helped," Elmer Hernandez, a researcher with Cofense, notes in the report.
Click to expand...

This phishing campaign shows that attackers are looking for new ways to bypass multifactor authentication.

"Not only is there no need to compromise credentials, but touted security measures, such as [multifactor authentication] are also bypassed; it is users themselves who unwittingly approve malicious access to their data," according to Cofense.
Hernandez does note, however, that this should not discourage companies from using two- or multifactor authentication as it does provide greater security protection.
Click to expand...

Cofense: MFA Bypass Phish Caught: OAuth2 Grants Access to User Data Without a Password

Log in or Sign up

Phishing Attack Bypassed Office 365 Multifactor Protections

guest Guest

Log in or Sign up

Phishing Attack Bypassed Office 365 Multifactor Protections

guest Guest

Useful Searches