Cyber Dives: One Token to Rule Them All

Lets walk a real threat actor phishing campaign. A financially motivated group is hijacking Microsoft accounts without ever stealing a password. No fake login page, no malware. They abuse a legitimate Microsoft authentication flow.

We will cover what the technique is, why it works, and how we tracked the operators running it through open source intelligence. Then a live demo of a reconstructed kit: watch a token land in the operator console and see what the attacker sees.

No prior experience required.