KritischAktivIm Trend
Critical Risk
95%
Microsoft 365 Phishing
Business email compromise and OAuth consent phishing targeting M365 tenants.
#phishing#bec#microsoft-365
Bedrohungsübersicht
Microsoft 365 phishing targets organizational credentials through fake login portals, OAuth consent grants, and session cookie theft aimed at BEC and data exfiltration.
Angriffsverhalten
- Fake Microsoft login on typosquat domains
- Malicious OAuth app consent requests
- Mailbox rule creation for persistence
Infektionswege
- Spear-phishing to executives
- Shared document lure emails
- Teams and SharePoint notification abuse
Symptome & Indikatoren
- Mailbox forwarding rules you did not create
- OAuth apps with excessive permissions
- Impossible travel sign-in alerts
Sofortige Abwehr
- Revoke suspicious OAuth grants in Entra ID
- Reset passwords and invalidate sessions
- Audit mail flow rules
Entfernungsanleitung
- Remove malicious inbox rules
- Review SharePoint external sharing
- Enable conditional access policies
Präventionsmethoden
- Phishing protection and safe link scanning
- Phishing-resistant MFA
- User awareness training
Telemetrie-Indikatoren
- Login from anonymizing proxies
- Consent grant to unknown app IDs
- Auto-forward to external domains
Attackers trick users into approving malicious apps that gain persistent API access to mail, files, and contacts without storing passwords.