Forest Global Training Partners

Cyber Risks · Krebs on Security

Tricky Phish Angles for Persistence, Not Passwords

Summary: A phishing tactic that re-emerged in late 2019 sends victims to the real login.microsoftonline.com page, where a crafted URL directs Microsoft to forward the resulting authorization token to an attacker-controlled domain such as officesuited[.]com. The user then approves an app requesting permission to read email, contacts, OneNote notebooks, files, mailbox settings and profile data, and the app retains that access until Microsoft disables it or a domain administrator removes it. PhishLabs reported the scheme in early December, and Microsoft disabled the officesuited[.]com app around December 19, roughly a week after it went live.

What's compelling: Because the login happens on Microsoft's own site, two-factor authentication does nothing here, and the malicious app was not visible at the individual user level - only administrators could see it had been approved. Microsoft disabled the app about a week after it went live, which is the window an attacker holds your email and files even after a password change.

Read the original at Krebs on Security ↗

Topics
Data Breaches
Related