We know that Microsoft uses EntraID as a universal sign-in service. What we didn't know is that it transmits the password in plain text.
Researcher Keanu Nys from Spotit in Belgium created a phishing platform from the official login page and can obtain the login details of any user.
The researcher customized the login page with CSS and was even able to capture MFA authentication checks. So it seems that Microsoft has made too many security-damaging “discounts” to have more features, thus making the entire MFA system vulnerable to Microsoft ID phishing attacks.
Specifically, Nys showed in his presentation at DEF CON 33 (2025) that users can be easily fooled with a simple CSS tweak, custom fonts, and displaying a few images on the login page.
Attackers can then use Pass Through Authentication (PTA) to check if the captured access data is valid. If they are, they “earn” a session ID that they can use across all Microsoft services (M365, OneDrive, and more).
Even MFA is not a barrier.
All "phishing" attempts appear to come from the official Microsoft domain.
This means they cannot be stopped by firewalls, DNS filters, and similar security measures.
It's hard to imagine how Microsoft can prevent these attacks.
Although the press releases will range from very select to rare, I said I'd pass...because sometimes the editors hide.
