Clever Phishing Attack Bypasses MFA to Nab Microsoft Office 365 Credentials – Expert Reaction

By   muhammad malik
Chief Editor , Information Security Buzz | May 20, 2020 11:57 pm PST

Cofence has discovered an attack that bypasses MFA to nab Microsoft 365 credentials. Researchers at Cofense Phishing Defense Center discovered the tactic, which leverages the OAuth2 framework and OpenID Connect (OIDC) protocol and uses a malicious SharePoint link to trick users into granting permissions to a rogue application, researcher Elmer Hernandez wrote in a blog post published Tuesday.

Notify of
2 Expert Comments
Oldest Most Voted
Inline Feedbacks
View all comments
Niamh Muldoon
Niamh Muldoon , Senior Director of Trust and Security EMEA
May 21, 2020 1:27 pm

Phishing is the mechanism for malicious attackers to gain access to organisation networks and/or systems and malicious attackers are moving away from traditional delivery mechanisms of phishing links such as email.

This new type of attack demonstrates that multi-factor authentication alone is not enough to protect against increasingly sophisticated phishing attacks and now even traditional forms of 2 Factor Authentication using something you know, like a password, whilst having tokens or pins, like an SMS and One-time-password, are at risk.

Multi-factor authentication using the something you are component (biometrics) reduces this risk. Leaders Digital Identity space are using AI to model user behaviours for access to systems and data, if a user’s risk profile changes then so do does their authentication mechanism along with ability to execute privileges, this makes it more complex and difficult for malicious attackers to be successful in gaining access.

Last edited 3 years ago by Niamh Muldoon
Dan Conrad
Dan Conrad , Field Strategist
May 21, 2020 7:58 am

This is a very well-crafted phish as it “front ends” O365 with a malicious SharePoint site. When the user authenticates to O365 it grants this site access to the user\’s data. It goes beyond the simple gaining of a user’s password and possibly moving laterally or elevating privilege. From an attacker’s perspective, this type of effort would be used for specific targets (aka “whaling”), where they would attempt to get specific account information from specific, high-level users. It’s a bit like a man-in-the-middle, but for O365. Once authenticated, they would have access to anything stored on the O365 platform such as corporate email, contacts, OneDrive, etc., which they can take and hold for ransom or use maliciously.

As organisations train users on phishing and who is after their identities, attackers are learning as well. This attack underlines the importance of separating privileged credentials from standard user credentials. Any account with elevated permissions should not be “phishable”.

Last edited 3 years ago by Dan Conrad

Recent Posts

Would love your thoughts, please comment.x