Microsoft creates fake Azure tenants to pull phishers into honeypots

Microsoft operates a deception program that spins up realistic Azure tenant honeypots (custom domains, ~20k user accounts) and actively submits credentials to phishing sites to lure attackers in; when adversaries log in (about 5% of seeded sites), Microsoft logs detailed activity (IPs, browsers, behavior, phishing kits) to map infrastructure, attribute actors, and improve Defender protections, claiming thousands of blocked connections and an ability to waste attackers' time while gathering intelligence.