Advisory: Persistent MFA Circumvention in an Advanced BEC Campaign on Microsoft 365 Targets

Originally published by Mitiga. Written by Mitiga's Research Team. Mitiga spotted a sophisticated, advanced business email compromise campaign, targeting Microsoft 365 organizations, leveraging inherent weaknesses in Microsoft 365 MFA, Microsoft Authenticator, and Microsoft 365 Identity Protection.These weaknesses effectively nullify the added security allegedly provided by multi-factor authentication (MFA), allowing for full compromise, even of accounts that have enabled MFA. BackgroundWe i...

advanced advisory bec campaign mfa microsoft microsoft 365 persistent