TrustSink: when external MFA becomes a password trap
Why businesses should review who can change their sign-in systems. The TrustSink research, its limits and three practical recommendations for administrators.
TOPIC
Identity & access
Conditional Access, MFA and sign-in flows, permissions and roles in Entra ID, privileged and service accounts, access granted to external suppliers.
Signing in on the real site, giving the attacker access: Microsoft 365 phishing
Phishing does not need to steal a password or imitate Microsoft. In device-code phishing, a user authorizes an attacker-created session on a legitimate site. The case shows why organisations must govern sign-in flows, not only inspect domains.