Security Weekly - A CRA Resource: Your MFA Problem Could Be Fake

Attackers are contacting people by phone or message with claims that their Microsoft MFA, passkey, or SSO configuration needs attention. They then direct the target to a fake Microsoft login page.

The page may look completely legitimate, but entering credentials can hand attackers both account credentials and session tokens. The initial phone call or message is designed to make the login request feel urgent and legitimate.

What should organizations and users verify before responding to an unexpected authentication warning?

Subscribe to our podcasts: https://securityweekly.com/subscribe

#Phishing #Microsoft #SecurityWeekly #Cybersecurity #InformationSecurity #AI #InfoSec