From 0 To Millions: Protecting Against AitM Phishing At Scale

The speaker opens with the growth of a free detection token that watches Microsoft Entra ID login pages for adversary-in-the-middle phishing. Reverse-proxy phishing kits relay the real login, so most MFA prompts can be passed through and the resulting session stolen. The core problem is a visibility gap: when identity is outsourced to a vendor, the tenant owner sees little telemetry until after authentication has already happened.

The sensor is a small CSS snippet added to the customized login page. It makes the browser fetch a one-pixel image hosted on AWS CloudFront, and the request's referrer is checked against Microsoft's domains. A missing or mismatched referrer raises an alert, which can reach the tenant owner with the source address and user agent before the victim types a password. Owners can then revoke sessions or push the alert to a webhook. The speaker walked through a live demo using an open-source phishing kit.

Deployment data showed that most phishing domains appear for a single day against one tenant, while a smaller persistent group lasts much longer. Cross-tenant reuse has grown to about 40 percent of observed domains, and many attacker certificates were issued the same day. Multi-day, cross-tenant domains are now shared through MISP at TLP:CLEAR. Caveats include referrer spoofing, a Chromium bug that ignores a referrer-suppression header, and security scanners triggering alerts. The main lesson is that outsourcing identity reduces detection visibility, and phishing-resistant credentials are the lasting fix.