#ShadyHacks with Kyle Hanslovan

The report demonstrates how attackers abuse identity-focused techniques to compromise Microsoft 365 without exploits or malware, starting with dark web credentials, phishing with ClickFix to steal session tokens, and session hijacking to bypass MFA; once inside, they establish persistence with inbox rules, move laterally via Teams, and reset passwords for non-SSO apps. It concludes with layered defenses including MFA with conditional access, auditing risky apps/inbox rules, strengthening email authentication (DMARC/DKIM/BIMI), incident response processes, and security awareness training.