Microsoft investigates Office Apps, Teams file access issues
… Earlier today, Microsoft addressed another incident that blocked customers from setting up multi-factor authentication MFA on some accounts or from accessing the MySignIn service. …
… Earlier today, Microsoft addressed another incident that blocked customers from setting up multi-factor authentication MFA on some accounts or from accessing the MySignIn service. …
… "We're investigating an issue where some users may be unable to setup MFA or access the http://mysignins.microsoft.com website," the company's Microsoft 365 Status account shared on Twitter earlier today. …
… Once the victim enters the code and completes MFA, Microsoft issues an OAuth access token that grants the threat actor full access to their account without requiring them to solve any MFA challenges. …
… In our test, we used a standard user account, and after running the exploit, it opened a command prompt with SYSTEM privileges, as shown in the image below. …
… After this step, Microsoft issues OAuth access and refresh tokens to the attacker-controlled device. …