Introduction In this blog, we will demonstrate how attackers can bypass Safe Links in Microsoft Defender for Office 365 to successfully deliver a phishing email with a fake login page link that captures both the user credentials and Microsoft Authenticator token from the user; bypassing two-factor authentication.
We will first explore the normal Safe Links behavior in blocking malicious links and then showcase bypassing that protection.
What is Microsoft Defender for Office 365? Microsoft Defender for Office 365 is a cloud-based protection service for Microsoft 365 suite. One of the protections it offers is Safe Links, which protects users from clicking on malicious links. Safe Links operates in real-time, which means it scans links for malicious content at the moment a user clicks on them.
More about Microsoft Defender for Office 365:
https://www.microsoft.com/en/security/business/siem-and-xdr/microsoft-defender-office-365 Lab Requirements For the demonstration purpose, we have set up our testing lab which has the following:
Phishing email domain: Will be used by the attacker to send the phishing email.
Phishing login page: Will have a phishing page where it asks the user to enter their credentials. The link of this page will be in the body of the phishing email.
Victim email domain: The target organization where an employee will receive
the phishing email from the attacker.
Microsoft 365 subscription: The main component for Microsoft 365 suite.
Microsoft Defender for Office 365 Plan 2: The cloud-based protection service for Microsoft 365 suite which has the Safe Links feature.
Evilginx: A man-in-the-middle attack framework used for phishing login credentials along with session cookies, which bypasses two-factor authentication protection.
Normal Safe Links Behavior
First, we create a phishing page to simulate the attack. Here, it's just a welcome page that prompts the user to login to Microsoft 365. This page can be a fake copy of the victim organization login page.