When legit is the trick: Phishing’s sneaky new moves.
About this episode
The episode discusses how attackers exploit legitimate Microsoft workflows for phishing attacks.
Welcome in! You’ve entered, Only Malware in the Building. Join us each month to sip tea and solve mysteries about today’s most interesting threats. Your host is Selena Larson, Proofpoint intelligence analyst and host of their podcast DISCARDED. Inspired by the residents of a building in New York’s exclusive upper west side, Selena is joined by her co-hosts N2K Networks Dave Bittner and Keith Mularski, former FBI cybercrime investigator and now Chief Global Ambassador at Qintel. Being a security researcher is a bit like being a detective: you gather clues, analyze the evidence, and consult the experts to solve the cyber puzzle. On this episode, our hosts discuss how attackers are increasingly abusing legitimate, trusted Microsoft workflows to make phishing campaigns more convincing and harder to spot. In device code phishing, victims are socially engineered into completing a real Microsoft OAuth login flow, inadvertently granting attackers valid access tokens without ever sharing a password. They also examined abuse of Microsoft 365 Direct Send, which allows threat actors to send phishing emails that…
More episodes of Only Malware in the Building
- Who’s logging in?
- AI swarms and cyber alarms.
- Poisoned at the source.
- Yippee-ki-yay, cybercriminals!
- Pass the intel, please.
- When malware goes bump in the night.
Explore listener stats, chart rankings, contacts and more on the Only Malware in the Building podcast page.