Microsoft 365 users beware: Phishing and identity threats are rising
What's the story
The Indian Computer Emergency Response Team (CERT-In) has issued a critical advisory, warning organizations about cyber attacks targeting Microsoft 365 (M365) accounts. The advisory, released recently, highlighted a combination of attack techniques like password spraying and device-code phishing. These tactics are being used to bypass authentication controls and gain access to organizational resources such as Exchange Online, Microsoft Teams, OneDrive, and SharePoint.
Corporate response
Microsoft collaborates with Indian authorities on cybersecurity issues
In light of CERT-In's advisory, Microsoft has acknowledged the evolving nature of identity and phishing threats targeting M365 environments.
A company spokesperson told Moneycontrol that they are working with Indian authorities to tackle these cybersecurity challenges.
The spokesperson added, "Microsoft works closely with Indian government cybersecurity agencies and regulators to advance the safety of organizations and citizens."
Attack strategies
CERT-In highlights sophisticated phishing attacks leveraging Microsoft authentication
CERT-In's advisory detailed how attackers are increasingly using legitimate Microsoft authentication workflows to compromise accounts, making some attacks harder to detect.
One such tactic is device-code phishing, where victims are tricked into authorizing a cyber attacker's device code through what seems like a legitimate Microsoft sign-in process.
The advisory also flagged the abuse of Resource Owner Password Credentials (ROPC) OAuth flow for large-scale password spraying attacks.
Security measures
Microsoft urges customers to bolster M365 defenses
In light of these threats, Microsoft has advised its customers to take additional steps to strengthen their M365 environments.
The company recommended reviewing "Microsoft Security and Entra guidance on phishing-resistant authentication, Conditional Access, device-code flow controls, token protection, application consent governance, and device identity management."
This comes after CERT-In warned that attackers could register rogue devices in Microsoft Entra ID after successfully completing device-code phishing attacks.
Customer assurance
Microsoft assures protection for updated customers amid rising attacks
When asked about the CERT-In advisory and its impact on Indian organizations, Microsoft did not provide specific figures.
However, the spokesperson assured that "customers who have installed available updates are already protected from these threats."
This assurance comes as attackers increasingly rely on legitimate cloud services and authentication mechanisms instead of traditional malware-based attacks.