Passkey/SSO update lure phishing email prior to AiTM credential theft
Detects incoming or urgent security-themed emails (related to MFA, SSO, or passkeys) that originate from purported IT departments and are followed by a user clicking a link associated with Microsoft or authentication portals. This behavior is indicative of credential harvesting or consent phishing campaigns masquerading as internal IT security updates.
Microsoft Sentinel (KQL)
