HACKERS STEAL MICROSOFT LOGINS USING LEGITIMATE ADFS REDIRECTS

Summary from the TLDR InfoSec newsletter

Push Security researchers found a new phishing attack using legit office.com links combined with ADFS to redirect users to a phishing page that steals Microsoft 365 logins. The attack starts when users click on malicious sponsored links in Google search results for Office 265 (likely typosquatting), which leads to Microsoft's office.com, then to a harmless-looking page that redirects to the phishing site. The attackers are using a custom Microsoft tenant with ADFS to receive authorization requests for the fake domain.