News
Expert Analysis: Microsoft Attack by Manipulation
January 2022 by Ric Longenecker, CISO at Open Systems
This week, Microsoft warned users against the OAuth consent phishing campaign, enabling cybercriminals to write and send emails through Microsoft user accounts.
According to new analysis from Ric Longenecker, CISO at Open Systems, which provides managed detection and response (MDR) service:
“Microsoft’s clear alert around OAuth and shady apps being used for infiltration further confirm consent phishing has become a top approach used by bad actors,” said Ric Longenecker, chief information security officer at Open Systems, the mission-driven cybersecurity services provider. “Consent phishing is a tried-and-true tactic that cybercriminals employ to secure the trust of users within a third-party application. This attack leverages continued prompts for the user’s permission, enabling a change to the victim’s mailbox settings, and essentially allowing the bad actor free reign for extended periods of time. Though employee education is helpful, the sophistication and frequency of these attacks means that some will inevitably succeed. Quickly detecting such intrusions can limit their impact through a Managed Detection and Response service that works in tandem with Microsoft Security.”
