Blog & Guides
Practical cybersecurity articles, step-by-step guides, and quick-reference cheat sheets — from Active Directory hardening to Microsoft 365 and zero trust. Written by someone who's done the work. No hype, no fluff.
2 results for “mfa” · Clear
Ghost Phishing: How the EvilTokens Campaign Hides in the Browser to Hijack Microsoft 365 Accounts
A new "ghost phishing" wave from the EvilTokens kit is slipping past email security by keeping its payload AES-encrypted until it renders in the victim's browser, then using Microsoft device-code phishing to take over Microsoft 365 accounts without ever stealing a password. This guide breaks down how the technique works, why traditional URL and email controls miss it, who is being hit, and the concrete detection and hardening steps to defend your tenant.
Entra ID Conditional Access Gaps: 10 Misconfigurations That Quietly Defeat MFA
The most common Entra ID Conditional Access gaps are policies that exclude too much, sit in report-only forever, ignore legacy authentication, skip device and risk signals, and leave break-glass accounts unmanaged. Here's how to find and close each one.