Turning Microsoft's Login Page into our Phishing Infrastructure
Keanu Nys
DEF CON 33 · Day 1 · Main Stage
Keanu Nys presents a class of abuse techniques that weaponize legitimate Microsoft authentication infrastructure — specifically Microsoft's own login pages and identity services — to conduct convincin
AI review
Microsoft's own authentication infrastructure weaponized as phishing infrastructure via OAuth abuse, application registration manipulation, and federation exploitation. Victim sees a real Microsoft URL and valid cert throughout. The meta-story about Microsoft's MSRC actively trying to suppress the talk is its own finding.