Phishing for Tenants: All I Wanted was for Microsoft to Deliver my Phishing ...
summary
Vaisha Bernard recounts using Microsoft’s Attack Simulation platform and building his own phishing simulation tooling, which exposed trivial security bugs that earned bug bounties. He describes intercepting client-side requests from Microsoft’s Security & Compliance Center, replaying them to backend APIs, and consequently gaining unauthorized access to other Microsoft 365 tenants and extracting their data.
AI-written summary · about
related talks
34mBingBang: Hacking Bing.com (and much more) with Azure Active Directory
49mAll You Need Is Guest
40mFighting Where They Aren't: How Attackers Avoid Endpoints in Modern Attacks
50mDefending Against New Phishing Attacks that Abuse OAuth Authorization Flows
01h 00mDefending Against New Phishing Attacks that Abuse OAuth Authorization Flows
55mAzure Attacks Unpacked: Real-World Threats & Lessons
48mLateral Movement in the Age of Hybrid Cloud
43mHunting for Bugs, Catching Dragons