The Fake Microsoft Login Page That Registered a Device
An AiTM phishing page proxied a real Microsoft 365 sign-in and registered an attacker device. Covers triage, containment, and the controls that stop it.
Entra ID
The Vendor Was the Phish: Responding to an AiTM Compromise in Microsoft 365
A trusted vendor's share link led to AiTM token theft and a phishing run from our user's mailbox. How we scoped it, cleaned it up and what stops it.