Phishing Campaign Exploits Microsoft Active Directory Federation Services (ADFS) to Bypass Multifactor Authentication

A phishing campaign is exploiting Microsoft Active Directory Federation Services (ADFS) to bypass multifactor authentication (MFA) and take over user accounts, allowing threat actors to commit further malicious activities across networks that depend on the service for single sign-on (SSO) authentication.

Community Health Center Data Breach Affects 1M Patients

However, even if an organization is still using ADFS, it still can take steps to protect itself. According to experts, all users should use phishing-resistant MFA whenever possible.

Protecting Against Phishing Campaigns

Other mitigations recommended by the researchers include:

• User education about modern attacker phishing techniques and psychological tactics
• The use of advanced email filtering, anomaly detection, and behavior monitoring technologies to identify and mitigate phishing attacks and detect compromised accounts early.