The Rise of Identity-Based Attacks
For years, cyber-attacks typically involved malicious links, malware downloads and infected devices. Today, threat actors are increasingly taking a different approach: abusing legitimate authentication processes to gain access without deploying malware at all.
One technique the Solis SOC is seeing more frequently is Device Code Phishing. Instead of tricking users into downloading malicious files, attackers persuade them to complete a legitimate Microsoft sign-in process, unknowingly granting access to their Microsoft 365 environment.
The result is an attack that can look remarkably similar to normal user activity.
Read Inside an AI‑enabled device code phishing campaign
How the Attack Works
The attack usually begins with a phishing email or message directing the user to a legitimate Microsoft authentication page. The user is asked to enter a device code and complete the sign-in process, including multi-factor authentication (MFA).
Once approved, the attacker receives valid authentication tokens that can provide access to email, files, Teams conversations and other Microsoft 365 resources.
Read Inside an AI‑enabled device code phishing campaign
Rather than exploiting vulnerabilities or deploying malware, attackers are leveraging trusted authentication workflows to gain a foothold inside the organisation.
Why It Matters
Identity-based attacks can be difficult to detect because many of the usual indicators of compromise are absent:
- No malware is deployed
- No ransomware is executed
- MFA may be successfully completed
- Traditional endpoint monitoring may show little or no suspicious activity
Yet attackers can still gain access to sensitive business data, communications and cloud services while appearing to be a legitimate user.
For many organisations, visibility into identity activity, authentication events and cloud services is now just as important as endpoint security.
What the Solis SOC Is Seeing
The Solis SOC continues to identify activity consistent with identity-focused attacks that rely on legitimate authentication mechanisms rather than malicious software.
Common indicators include:
- Unusual sign-in activity
- Unauthorised device registrations
- Suspicious OAuth and device code authentication events
- Unexpected, delegated access permissions
- New inbox rules or forwarding rules
- Microsoft Graph reconnaissance activity
These techniques allow threat actors to blend into normal business operations, making detection more challenging without the right monitoring and visibility.
Why Visibility Matters
Many security programmes have traditionally focused on endpoints. However, when an attack takes place entirely through identity and cloud services, there may be little evidence on the device itself.
As attackers continue to target identities rather than endpoints, organisations need visibility across authentication activity, cloud applications and user behaviour to identify suspicious activity before it leads to a wider compromise.
Key Takeaway
Attackers no longer need to deploy malware to gain access to your environment. Increasingly, they are exploiting trusted authentication processes to blend in as legitimate users.
Organisations that can monitor identity activity, cloud services and authentication events are far better positioned to detect these attacks early and reduce the risk of unauthorised access.
The question is no longer just "Do we have endpoint monitoring?" It is increasingly "Can we detect identity compromise when it happens?"