Turning Microsoft's Login Page into our Phishing Infrastructure
Demonstrates how red teams can abuse legitimate Microsoft login branding parameters and OAuth endpoints to host convincing, high-trust phishing infrastructure.
Summary
Abusing Trust in Enterprise Identity Portals
Users and automated email security filters are trained to trust authentic Microsoft login domains (such as login.microsoftonline.com) during enterprise single sign-on (SSO) workflows.
Manipulating Tenant Branding and OAuth Parameters
Keanu Nys reveals how attackers can abuse Microsoft Entra ID tenant branding features, customizable login pages, and OAuth 2.0 authorization endpoints to present highly customized phishing lures hosted entirely on legitimate Microsoft infrastructure.
Bypassing Modern Email Filters and Security Gateways
Because the underlying links point to valid Microsoft certificates and domains, automated Secure Email Gateways (SEGs) fail to classify the redirection links as malicious.
Defensive Detection and Conditional Access
Mitigating identity portal abuse requires enforcing FIDO2 phishing-resistant authentication, configuring strict Entra ID cross-tenant access restrictions, and monitoring abnormal OAuth consent grants.
Related talks
Creator Stage·24 min
Chad Spensky
Demonstrates an effective phishing attack vector against synced passkeys and outlines operational safeguards for enterprise passkey deployments.
Main Stage·36 min
Harrison Sand · Erlend Leiknes
Analyzes the evolution of enterprise phishing defense and demonstrates novel reverse-proxy adversary-in-the-middle tradecraft to bypass modern authentication.
War Stories·47 min
Jayson E. Street
Demonstrates how generative AI tools enhance phishing and vishing operations and outlines strategies to build organizational situational awareness.