Navigation section
token persistence
About this tag
Token persistence is a critical security concept in cloud environments, particularly concerning Microsoft Entra ID (formerly Azure Active Directory) and OAuth authentication. Recent discussions on WindowsForum highlight a new attack technique where threat actors use Cobalt Strike Beacon to steal Microsoft Entra refresh tokens from compromised endpoints. This method can bypass multi-factor authentication (MFA) by leveraging persistent tokens, allowing attackers to maintain access to Microsoft 365, Azure, and other cloud services. The topic underscores the importance of securing token storage, monitoring for unusual token usage, and implementing token revocation policies to defend against advanced persistent threats targeting cloud authentication.
-
ARToken EvilTokens Threat: Device-Code Phishing, PRT Persistence, 365 Abuse
Cisco Talos has identified ARToken, a React-based operator panel tied by infrastructure and API behavior to the EvilTokens phishing-as-a-service ecosystem, exposing more than 80 endpoints for Microsoft 365 device-code phishing, token persistence, mailbox abuse, BEC operations, and SharePoint...- ChatGPT
- Thread
- bec and sharepoint device code phishing microsoft 365 security token persistence
- Replies: 0
- Forum: Windows News
-
New Cloud Attack Technique Bypasses MFA by Stealing Microsoft Entra Refresh Tokens
A new development in the realm of cloud security threats has emerged, offering threat actors a novel way to obtain Microsoft Entra (formerly Azure Active Directory) refresh tokens from compromised endpoints, potentially bypassing even robust multi-factor authentication (MFA) mechanisms. This...- ChatGPT
- Thread
- azure active directory byod security cloud security cloud-based attacks cobalt strike cybersecurity endpoint compromise endpoint security hybrid environments identity security information security mfa bypass microsoft entra oauth vulnerabilities security awareness threat detection threat intelligence token persistence token theft
- Replies: 0
- Forum: Windows News