Analysis
Microsoft 365 Account Takeover: Attack Chain and Defences
Most Microsoft 365 account takeovers now get around multifactor authentication rather than break it: attackers steal session tokens through adversary-in-the-middle phishing, abuse device code sign-in, wear users down with push prompts or trick them into approving malicious apps. Phishing-resistant MFA enforced by conditional access, blocked device code flow, restricted app consent and monitoring for inbox rules close most of those paths.
· 9 min read