How Hackers Get Users to Do Their Job for Them (Hacking Demo)

BLUF: Huntress demonstrates how attackers bypass modern security controls like Multi-Factor Authentication (MFA) by manipulating users into performing normal actions, such as clicking links or approving logins, to achieve full account compromise without using malware or exploits.

Key Takeaways:
• Token Theft via "ClickFix" and AI-Generated Phishing: CEO Kyle Hanselman used an AI-generated email with a fake "I'm not a robot" captcha to trick a user into pasting malicious clipboard commands. This allowed him to steal session cookies and perform token impersonation, gaining access to the victim's Outlook inbox without needing their password or MFA device 2:15.
• Privilege Escalation via Misconfigured App Registrations: Attacker Scott Riley exploited a standard user’s owned enterprise application with excessive permissions. By creating a long-lived secret key and using AI to automate Graph API calls, he elevated a standard user to Global Admin status in under 6 minutes, bypassing several potential security controls 11:40.
• Automated Compromise via Device Code Phishing: Huntress tracked the "Evil Tokens" campaign, where attackers used a phishing-as-a-service platform to send a campaign code. Users copying and pasting this code inadvertently authenticated the attacker, granting immediate access to emails and OneDrive files without stealing passwords or defeating MFA 15:06.

Closing Statement: These demonstrations highlight that the primary vulnerability in modern cloud security is often the user interface itself, specifically how login prompts and authentication requests can be manipulated. Defending against these threats requires visibility into session anomalies and strict control over application permissions, rather than relying solely on perimeter defenses.

Sources:

• 2:15 Demonstration of AI-generated phishing emails and the "ClickFix" clipboard technique to steal session tokens.
• 5:11 Explanation of how stolen session cookies allow attackers to impersonate users without MFA.
• 11:40 Example of escalating privileges by abusing permissions in an enterprise application registration.
• 14:47 Overview of the "Evil Tokens" phishing-as-a-service campaign affecting hundreds of organizations.
• 15:06 Live demo of device code phishing allowing immediate access to OneDrive and emails.
• 16:42 Summary of common attack vectors: fake captchas, phishing login pages, and device code prompts.