Off-topic for aiqbench

This story was gathered from a source we follow but falls outside AI and quantum coverage, so there is no aiqbench take for it.

Hackers Let Victims Complete MFA Then Steal the Entire Microsoft 365 Session

Cybersecurity NewsJuly 22, 20265 min read

Multi-factor authentication is meant to stop stolen-password attacks. A newly documented phishing technique instead persuades users to approve a real Microsoft sign-in, allowing attackers to take over the resulting Microsoft 365 session without directly stealing credentials. The campaign abuses the OAuth device-code flow, a feature intended for devices such as smart TVs and meeting-room systems […] The post Hackers Let Victims Complete MFA Then Steal the Entire Microsoft 365 Session appeared first on Cyber Security News.

Multi-factor authentication is meant to stop stolen-password attacks. A newly documented phishing technique instead persuades users to approve a real Microsoft sign-in, allowing attackers to take over the resulting Microsoft 365 session without directly stealing credentials. The campaign abuses the OAuth device-code flow, a feature intended for devices such as smart TVs and meeting-room systems that cannot easily display a normal login page. Attackers send a code through a convincing document-sharing or account-verification lure, then wait for the victim to enter it on Microsoft’s genuine…

Excerpt shown under the publisher's RSS terms · 85 words · full text and figures are on the publisher's site

Read at Cybersecurity News ↗Ask about this article