"Clever Phishing Attack Bypasses MFA to Nab Microsoft Office 365 Credentials"

Researchers at Cofense have discovered a new phishing campaign that can bypass multi-factor authentication (MFA) on Office 365 to access victims' data stored on the cloud and use it to extort a Bitcoin ransom and to find new victims to target.  The phishing campaign leverages the OAuth2 framework, and OpenID Connect (OIDC) protocol and uses a malicious SharePoint link to trick users into granting permissions to a rogue application.  

Threatpost reports: "Clever Phishing Attack Bypasses MFA to Nab Microsoft Office 365 Credentials"