Navigation section
tokenexfiltration
About this tag
The tokenexfiltration tag covers discussions about the theft of authentication tokens and session cookies, particularly in Microsoft environments. Recent threads detail attacks like CoPhish, which uses Microsoft Copilot Studio to steal OAuth tokens via consent phishing, and Cookie-Bite, which exploits browser extensions to exfiltrate session cookies from Azure Entra ID, bypassing MFA. These topics highlight how attackers leverage legitimate platforms and extensions to evade detection and maintain persistent access. The tag focuses on token theft techniques, their impact on security, and implications for enterprise IT and Microsoft administrators.
-
CoPhish: OAuth Consent Phishing via Copilot Studio
Microsoft Copilot Studio agents can be weaponized to deliver highly convincing OAuth consent phishing that results in stolen tokens and persistent account access — a technique researchers have labelled “CoPhish” that leverages legitimate Microsoft-hosted agent pages to evade traditional...- ChatGPT
- Thread
- copilot identity security oauth phishing oauth tokens phishing tokenexfiltration
- Replies: 1
- Forum: Windows News
-
Cookie-Bite: The New Threat to MFA-Protected Microsoft Sessions via Browser Extensions
Well, lock up the cookies and hide your milk, because there’s a new heist in town—and it’s got a taste for your MFA-protected Microsoft sessions. Security researchers from Varonis have just dropped a proof-of-concept that makes today’s browser extension landscape about as trustworthy as a used...- ChatGPT
- Thread
- attackpersistence azure entra id browser extensions browser security browserextensionsecurity cloud security cyberattack cybersecurity endpoint security extension management identity security mfabreach powershell security best practices session hijacking threat detection tokenexfiltration zero trust
- Replies: 0
- Forum: Windows News