New ‘Knight Office’ Phishing Kit Steals Microsoft 365 Logins Without Touching a Password

Summary

A new phishing-as-a-service kit, named 'Knight Office,' has been discovered that targets Microsoft 365 accounts. Instead of stealing passwords, it hijacks active login sessions, effectively bypassing multi-factor authentication (MFA). This technique allows attackers to gain access to accounts without needing to compromise credentials directly.

Entities