Attackers Use Fake OAuth Apps with Tycoon Kit to Breach Microsoft 365 Accounts

Summary

Attackers are using fake Microsoft OAuth apps to breach Microsoft 365 accounts via phishing. The campaign uses phishing emails and fake Microsoft pages to harvest credentials and MFA codes. Microsoft plans to update security settings to counter these attacks.

Key Takeaways

1. Attackers are using fake Microsoft OAuth applications to harvest credentials and conduct account takeover attacks.
2. The attacks involve phishing emails, fake Microsoft OAuth pages, and adversary-in-the-middle techniques to steal credentials and MFA codes.
3. Microsoft plans to update default settings to improve security by blocking legacy authentication protocols and requiring admin consent for third-party app access.

Statement Breakdown

• Claimed Facts: 75% of statements the article presents as facts
• Opinions: 15% of statements classified as editorial or subjective
• Claims: 10% of statements surfaced for additional reader evaluation

Credibility & Bias Reasoning

Credibility assessment: The article is based on reports from cybersecurity researchers and security companies like Proofpoint and Seqrite, which are generally reliable sources. It also references Microsoft's official announcements. The article presents factual information about cybersecurity threats and countermeasures, enhancing its credibility.

Bias assessment: Security-focused. The article focuses on cybersecurity threats and preventative measures, presenting information from a security perspective. It highlights vulnerabilities and potential risks, aiming to inform readers about security concerns. The language used is technical and objective, with a focus on factual reporting.

Note: This article presents information about cybersecurity threats. Exercise caution when interpreting the potential impact and implement recommended security measures.

Credibility flag: Informative, Vigilant

Claimed Facts (7)

• This is a factual statement from a security company's report.
• This describes the timeline and technical details of the attack.
• This provides specific numbers related to the scale of the attacks.
• This is a verifiable announcement from Microsoft.
• This is another verifiable decision from Microsoft.
• This is a factual statement from Seqrite about malware deployment.
• This is a factual observation from WithSecure about phishing tactics.

Opinions (4)

• This is an assessment of the attacker's strategy.
• This is a prediction about future trends in cyberattacks.
• This is an opinion on the effectiveness of Microsoft's security updates.
• This is a speculative assessment of the role of RMM tools.

Claims (2)

• The notability of the attack is subjective and not clearly substantiated.
• The phrase "just a drop in the bucket" is vague and lacks precise quantification.

Key Sources

• Proofpoint — Enterprise security company
• Seqrite — Cybersecurity company
• WithSecure — Cybersecurity company
• Microsoft — Technology company
• Author — The Hacker News