AiTM Sign-in Pattern: Error 50074 Followed by Error 50140

Ibrahim Saud@tektrix

•updated Sep 16, 2026•0•0•5

Detects potential Adversary-in-the-Middle (AiTM) phishing activity by monitoring specific Azure AD sign-in failure codes (50074: strong authentication is required, 50140: interruption of sign-in) in conjunction with logins from unmanaged devices.