In recent times, attacks on Microsoft 365 accounts with enabled MFA have become more frequent and successful. Unfortunately, users often remain unaware that their accounts have been compromised.
Watch our short video on how the attack works, and what we’re doing to stop it.
Traditional Phishing Methods
Historically, attackers would create fake login screens to deceive users into entering their credentials. If MFA was enabled, this often thwarted the attack, as the second authentication step (like a mobile app or SMS code) acted as a barrier.
Microsoft reported that 99.9% of these identity-based attacks were thwarted by MFA, and started requiring it as part of their Security Defaults rollout, leading to widespread adoption among Microsoft 365 tenants.
Rise of New Attack Methods
Recently, open source tools like Evilginx have emerged, enabling attackers to steal authenticated session cookies. Attackers craft convincing phishing emails with fake login URLs that closely mimic legitimate sites. Unsuspecting users, seeing what appears to be a familiar login screen, enter their credentials and complete MFA, unknowingly handing over their session cookies to attackers.
With stolen session cookies, attackers gain full access to victims’ Microsoft 365 accounts, including emails, files, and sensitive company data. This access allows them to impersonate users effortlessly.
Current Countermeasures
Clarion - First Line of Defense
To combat evolving threats, our team employs Clarion, an open-source tool designed to detect phishing attempts. It warns users when they land on a suspicious login page, preventing them from entering their credentials.
24×7 Security Operations Center (SOC) Monitoring
Recognizing that 90% of attacks occur outside regular business hours, our SOC ensures immediate response and mitigation, even over weekends.
Enhanced Phishing Protection
Utilising advanced AI mail filtering tools, we intercept and prevent malicious emails from reaching users’ inboxes, minimizing the risk of phishing attacks.
Country-Based Restrictions
Previously, we were blocking a list of high-risk countries and enforcing MFA on all other login attempts. Moving from a high-risk country block list to an allow list model ensures that access attempts from unauthorized countries are automatically blocked, reducing exposure to external threats.
Stricter VPN Authentication
Implementing upgraded security measures for VPN access ensures that only authenticated and authorized users can connect, mitigating the risk of attackers using VPNs to bypass country restrictions.
Security Awareness Training
Regular online training sessions educate staff on identifying and avoiding phishing attempts, empowering them to be the first line of defense against cyber threats.
Ongoing Phishing Simulations
Regular phishing simulations test users’ ability to recognize and avoid phishing emails, reinforcing security awareness throughout the organization.
Advanced Security Options
For organisations requiring higher security standards, we offer passkey implementation, hardware key authentication and a zero-trust security model. Contact us to discuss tailored security solutions.
Conclusion
Protecting your Microsoft 365 environment against sophisticated attacks requires proactive measures and continuous adaptation to emerging threats. By implementing robust security strategies and educating your team, you can significantly reduce the risk of account breaches and data loss.
For more information on securing your Microsoft 365 environment, please contact us at 1300 369 111 or info@gcit.com.au.
