Microsoft 365

Attackers are phoning executives, posing as IT support, to steal Microsoft 365 logins. Four cheap checks close most of the gap this technique relies on.

The Kratos phishing kit stole Microsoft 365 session cookies to bypass MFA entirely. Here’s exactly how that attack works, and the practical steps that actually reduce the risk.