Signal & Noise, Volume 11

Token taken, trust shaken

Someone signed in through a phishing page that passed every keystroke to the real Microsoft login. Right password, right code, right everything. The attacker got the session anyway.

Someone clicked a link in Outlook and got a Microsoft login page seven seconds later. The domain was one character off a real company's, a lowercase q sitting where a g should be.

Everything after that looked right, because it was right. The URL bar still read the typosquat domain, but the page itself was a proxy, handing every field to the real Microsoft login and passing the answers back, MFA prompt included.

This is adversary-in-the-middle. The page is fake, but it isn't a mockup. It proxies the real thing, sitting between you and the genuine login and relaying traffic both directions, so you see real Microsoft responses and Microsoft sees a real user. Your password works. Your MFA code works. When the login completes, Microsoft issues a session cookie and the proxy keeps a copy of it.

The tell was in DNS. Right after the login page loaded, the endpoint resolved two long random subdomains off the same wildcard, then did it again five minutes later. Hostnames like that are generated per session, which is reverse-proxy kit behavior, and the repeat means the page was still open.

So we went hunting for that session being used. Every IP that touched the mailbox afterward was either the office egress or Microsoft itself, and the one token exercised was issued 80 minutes before the click.

The endpoint agreed. Nothing spawned from the browser, nothing downloaded from the chain, no persistence, no detections, and one host in the whole fleet ever touched the domain.

None of that reads itself. Dylan Haase worked this case, and he spends his own time on the offensive side, top 1% on TryHackMe. That's why two throwaway DNS records registered as a phishing kit, and why a token timestamp became the alibi that cleared the account.

Here's the part that keeps you honest. A stolen refresh token is good for up to 90 days, so quiet telemetry means it hasn't been used yet. You revoke. You don't watch and hope.

This Week in Cyber History

September 18 · 2017 · Global

Nine years ago this week, researchers revealed that CCleaner, a trusted PC cleanup tool, had been shipping a backdoor for a month. Attackers compromised the build servers, so the malware was inside the official download and carried a valid signature. Roughly 2.3 million people installed it. Every one of them did everything right.

Case at a Glance

What fired — Phishing URL click, endpoint-confirmed page load

Landing page —Typosquat login page, one character off a real domain

Technique —Adversary-in-the-middle proxy; session-cookie theft, MFA bypassed

Verdict — Malicious; no account or endpoint compromise

Response —Credential rotation, token revocation, wildcard domain block

Why This Matters

MFA is a control, not a shield. A proxy kit passes your second factor straight through and keeps the session, so "we have MFA everywhere" is not the same as being safe from phishing.

And clean telemetry isn't the same as safe. A stolen session can sit unused for weeks, so the only real close is rotating the credential and confirming the tokens died.

Meet the Analyst

Dylan Haase, SOC Analyst

Dylan spent his early career in military intelligence before earning a computer science degree from the Colorado School of Mines. He is drawn to the full picture of how attackers operate and how defenders catch them.

He brings blue team expertise to RADICL as a SOC Analyst defending Defense Industrial Base contractors, while pursuing red team skills on his own time, pairing both perspectives into a well-rounded security skill set.

“To defend the Defense Industrial Base, you have to think like the people trying to break in. So I practice both.” — Dylan Haase, SOC Analyst, RADICL

Case Spotlight

True Positive · Quarantined

Four malware detections fired on one laptop inside half an hour, all of them cached files dropped by Chrome. The sample was a bundled installer from an adware family, two years old and well cataloged, flagged by 20 of 67 engines. Killed and quarantined, and the surrounding telemetry showed nothing further. Drive-by bundling, not an intrusion.

True Positive · Contained

A payroll manager clicked a fake shared-document link and landed on a typosquat page that handed them an access code to paste into a real Microsoft sign-in. That is device-code token theft, so the password was never exposed and resetting it would have fixed nothing. We disabled the account and revoked refresh tokens. Sign-ins and mail rules came back clean.

True Positive · No Action Required

A burst of user phish reports tripped seven submission alerts in one window. The cause was a commodity health-scam campaign rotating bait copy across three throwaway domains. Ordinary affiliate spam, except it reached the inbox instead of junk and hit several mailboxes inside two hours. No credential harvesting, no malware, no compromise. We closed the batch as one campaign cluster.

Eye on the Threatscape

01 —  Microsoft found a million scam emails in three days 

Microsoft disclosed two campaigns this month. One sent over a million CEO-impersonation emails in 72 hours through legitimate third-party delivery services, asking accounts payable for a $50,000 ACH transfer against a fake invoice. The other used passkey-themed social engineering to get into cloud tenants. Both abuse trust in the plumbing instead of breaking it.

Read more

02 —  An AI model broke into real systems again 

Anthropic disclosed a fourth case of one of its own models compromising real third-party systems, this time an early build of Claude Opus 4.6 that was told it was in a sealed simulation and wasn't. It harvested credentials and read someone's personal data. Four disclosures is a pattern, and the pattern is agents with more reach than oversight.

Read more

03 —  Six governments refreshed the Active Directory playbook 

CISA, NSA, and four allied agencies updated their joint Active Directory guidance on September 15, covering the 17 techniques attackers use to take over AD with the mitigation and detection for each. Free, specific, and about as close to a checklist as an SMB is going to get.

Read more

vSOC Tip of the Week

Check the domain before you type, not after. Proxy kits put a pixel-perfect Microsoft login in front of you and MFA won't save you. The address bar is the only tell, and one swapped letter is the whole attack. If anyone signs in after clicking an email link and then has second thoughts, tell us that day. We'd rather revoke a session than find out later it was used.

Prefer this newsletter as a PDF? Download it here.