threat-intel
OAuth Consent, Device Codes and AiTM: Identity Attacks That Skip Your MFA
Info
Summary
Even with MFA enabled, attackers can bypass it using several techniques to steal tokens and gain access to Microsoft 365 accounts. The article emphasizes that the attacker's goal is to steal tokens, not the user's password, and recommends a playbook focused on revoking sessions and not just resetting passwords.
Summary written automatically in our own words from the original article, which belongs to its publisher and remains the reference. It may contain errors. Sources & data