Microsoft Authentication Broker

Reported Context (1)

The OAuth client the operator impersonates is Microsoft Authentication Broker (AppId 29d9ed98-a469-4536-ade2-f981bc1d605e), a Microsoft first-party application that brokers tokens to Exchange Online, Microsoft Graph, Tycoon 2FA Operators Turn to OAuth Device-Code Phishing to Steal Microsoft 365 Tokens

MITRE ATT&CK (6)

Vendors (4)

Products (6)

Tools (2)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.