What Microsoft 365 penetration testing involves, what Microsoft allows, the weaknesses testers find most often, and how to prepare your tenant.
Tag:
MFA
-
-
Session hijacking lets an attacker take over a logged-in account without a password or MFA code. Here is how it works, the main types, and the fixes that matter.
-
MFA blocks the vast majority of account takeovers, but attackers now have working playbooks against weaker forms of it. Here is how MFA works, how it gets bypassed, and a …
-
A Russian state-backed campaign against Zimbra webmail went straight for 2FA backup codes, not passwords. Here is why that part of MFA gets ignored, and what to do about it.
-
Attackers are phoning executives, posing as IT support, to steal Microsoft 365 logins. Four cheap checks close most of the gap this technique relies on.
-
New passkey attacks bypass phishing-resistant MFA on Windows and Chrome. Here is what IT teams should patch and review right now.
-
Two members of Scattered Spider have pleaded guilty over the 2024 TfL breach. The techniques they used are low-tech and still active. Here is what organisations can do to make …