Your password is dangerous. It’s easy to steal, and if it unlocks your account on its own then you’re in serious trouble. That’s why two-factor authentication (2FA) is critical and it’s why Microsoft now says it wants to delete passwords for a billion users.
But if your account is unlocked with a password and a simple 2FA SMS code, you’re also in serious trouble. Those texted codes are easy to bypass, intercept or steal, either technically or by tricking users into sharing them. That’s why Microsoft, Google and others are pushing passkeys, linking your account access to your physical hardware.
Now you have something new to worry about. A new type of attack that’s spreading rapidly and could see you losing everything on your PC through one simple mistake. I warned last week about ClickFix, fraudulent popups that trick users into copying, pasting and running scripts on Windows PCs to fix non-existent technical problems or allow access to a restricted document or website.
ProofPoint warns ClickFix attacks have become increasingly popular “in cybercrime over the last year as well as in espionage campaigns in recent months.” ClickFix attacks usually load malware onto your PC, to either hunt down and steal credentials or data, or in more extreme cases, they can remotely hijack your PC.
We have now seen a variation of that theme, with new attacks tricking users into sharing the URL strings on their PCs that include multi-factor authentication tokens. “If the victim shares the OAuth code,” Volexity says, “the attacker is then able to generate an access token that ultimately allows access the victim’s M365 account.”
Now the email security team at SlashNext warns that a new attack dubbed “SessionShark O365 2FA/MFA” has been designed “to bypass Microsoft Office 365 multi-factor authentication (MFA) protections” in a different way.
This is “an adversary-in-the-middle (AiTM) phishing kit that can steal valid user session tokens to defeat two-factor authentication on Office 365 accounts.” The kit is being sold under the ridiculous guise of an educational tool. It will quickly get into attackers’ hands and be used to power phishing campaigns targeting Microsoft account holders.
As such, it’s now critical that you set up passkeys for your Microsoft, Google and other key accounts. And you must not sign into your accounts through login windows that are accessed via links in emails, messages, forum posts or attachments. If you need to sign into your account, only ever do so through usual methods.
AI now makes it easy for attackers to exactly replicate brands, logos, sign-in windows and even CAPTCHAs. They deploy techniques to hide from the automatic tools used to hunt down and stop such phishing websites. And the attacks are working.
“A successful credential theft still depends on tricking the victim,” SlashNext says. “SessionShark claims to ‘mimic the Office 365 login interface with high fidelity’ and even ‘dynamically adapts to various conditions for increased believability.’ In other words, the phishing pages look just like real Microsoft login screens, and may even handle different login workflows or error messages seamlessly. By making the user experience convincing and contextually appropriate, the kit helps attackers harvest credentials even from wary users.”
You have been warned.
