Tag
4 articles covering Entra ID across campaign analysis, detection engineering, and defender tradecraft.
Field Analysis
Microsoft tracked Storm-3121 and Storm-3032 running passkey-themed helpdesk calls since May 2026. The passkey narrative is a pretext that routes victims into AiTM and device-code flows — and the detection lives in what happens after the token lands, not in the lure.
Read more:Microsoft Security BlogBleepingComputer
Field Analysis
Two large Entra ID campaigns used hundreds of thousands to millions of fictional OAuth client IDs to spread account enumeration across apparent applications.
Field Analysis
Device code phishing turns a legitimate OAuth flow into a credential-free token theft technique. Here is how it runs end-to-end and what defenders can hunt on in Sentinel and Defender XDR.
Read more:Microsoft Security BlogIETF
Field Analysis
Most M365 phishing incidents are decided in the first hour. This walkthrough lays out a 60-minute response chain from user report to refresh-token revocation and consent reversal.