Summary: Abusing Microsoft's Login Infrastructure for Credential Theft

This presentation reveals multiple critical vulnerabilities in Microsoft's authentication infrastructure that allow attackers to steal user credentials while remaining entirely on Microsoft's trusted login domain (login.microsoftonline.com). The researcher declined Microsoft's repeated requests for preview slides, believing they would dismiss the vulnerabilities as not meeting servicing requirements.

Key Techniques Exploited:

1. Open Redirect Vulnerabilities

• Federation-based redirects: Attackers configure a domain in their tenant with a sign-in URL pointing to a phishing page, crafting URLs that redirect users while appearing to use Microsoft's domain
• App registration redirects: Creating app registrations with redirect URLs to phishing pages, bypassing consent prompts using parameters like "prompt=none"
• Invalid scope redirects: Using invalid scope parameters that trigger errors after authentication, redirecting users to attacker-controlled sites even with restrictive consent settings

2. Self-Service Signup Exploitation

• Attackers leverage self-service signup flows to collect custom attributes including "password" and "MFA code"
• API connectors validate these credentials against Microsoft's infrastructure in real-time
• Users remain on legitimate Microsoft domains while their credentials are captured and verified

3. Custom CSS Branding Manipulation

• Despite Microsoft's filtering, researchers discovered ways to inject CSS that hide legitimate sign-in buttons
• Attackers replace these with malicious buttons that redirect users to attacker-controlled sites
• Using self-service password reset customization, attackers create convincing fake buttons positioned exactly where legitimate ones would appear

4. Advanced Domain Spoofing with Custom Fonts

• Attackers register look-alike domains (e.g., micro-off.com) and create custom fonts where a hyphen character