The Fake Microsoft Login Page That Registered a Device

An AiTM phishing page proxied a real Microsoft 365 sign-in and registered an attacker device. Covers triage, containment, and the controls that stop it.

October 9, 2026 · Updated October 11, 2026 · 9 min · secderr