Awareness - MFA protects but make sure the site is okay

Awareness - MFA protects but make sure the site is okay

version: 2022-04-14

Introduction

MFA is a good way to protect against hackers, but on Tuesday, Microsoft detailed an ongoing large-scale phishing campaign that can hijack user accounts when they're protected with MFA designed to prevent such takeovers.

TL;DR:

  1. Check the site URL is correctly spelled
  2. If need be verify the site by clicking on the lock next to the URL, for myDRE:
    1. Click: Connection is secure
      1. Chrome: Certificate is valid
      2. Edge: icon left of the X
    2. It should display something like
      1. for myDRE.org:
        1. Issued to: mydre.org
        2. Issued by: Go Daddy Secure Certificate Authority - G2

Read the full article:

https://arstechnica.com/information-technology/2022/07/microsoft-details-phishing-campaign-that-can-hijack-mfa-protected-accounts/