For the first time in the history of Microsoft, a cyberattack has left hundreds of executive accounts compromised and caused a major user data leak as Microsoft Azure was attacked.
According to Proofpoint, the hackers use the malicious techniques that were discovered in November 2023. It includes credential theft through phishing methods and cloud account takeover (CTO) which helped the hackers gain access to both Microsoft365 applications as well as OfficeHome.
every day i lose my mind a little more at how much trust hundreds of thousands of companies across the world place in third parties like microsoft to handle literally all of their sensitive data, as if that could be a good idea in any universe
While I don’t disagree it’s dangerous, most companies handling their own data would likely do a lot worse, just with smaller chance of being targeted.
The reason why so many people fell for this attack was because it was carried out through malicious links embedded in documents. These links led to phishing websites but the anchor text of these links was “View Document”. Naturally, no one was suspicious of a text like that.
On one hand, I know we shouldn’t blame people for falling for this stuff. People are often not educated well enough on the dangers and it’s not reasonable to expect it. We should build things to be systematically secure even in the face of people falling for phishing.
On the other hand it’s difficult not to be frustrated with this kind of thing… People really should know better than clicking random links and typing their password.
I work on service desk.
Nobody knows their password. It’s always a fucking song and dance when I ask them to type it in.
Except of course when they click a phishing link. Then they know every single piece of information required.
Blows my mind
work on service desk.
Nobody knows their password.
If they did they wouldn’t be contacting the service desk.
I often get confused at how someone could log into the computer and yet after that is done have no idea what their password is. I sometimes have them lock their computer so they can remember it again. Facepalm.
