Cybersecurity researchers have uncovered a sophisticated technique to bypass Microsoft’s phishing-resistant multi-factor authentication (MFA) by exploiting the device code authentication flow and Primary Refresh Tokens (PRTs). The current advancement focuses on reliably forcing MFA during authentication, making it possible to execute the full attack chain against environments with stringent security policies. “After a quick test our assumption was correct!” the researchers noted, referring to their discovery that the “amr_values=ngcmfa” parameter could force users to perform MFA during authentication flows. Researchers found they could force MFA during authentication by manipulating request parameters, regardless of existing security policies. As organizations increasingly rely on passwordless authentication methods like Windows Hello, this research highlights the importance of a defense-in-depth approach rather than depending solely on phishing-resistant MFA. When users complete authentication (including MFA), attackers obtain authorization codes that can be exchanged for access and refresh tokens. Microsoft’s design prevents administrators from viewing their own authentication methods in Entra ID, requiring another admin to check for suspicious activity. Cyber Security News is a Dedicated News Platform For Cyber News, Cyber Attack News, Hacking News & Vulnerability Analysis. The technique was initially developed for an internal “EntraIDiots” Capture The Flag (CTF) competition, where participants had to overcome a challenge that only permitted access using phishing-resistant MFA. The compromised authentication method doesn’t appear in the user’s account page that lists other authentication methods. “From a user perspective it’s quite difficult to detect that a new WHFB key was added,” the researchers explained. Due to limitations in Entra ID’s audit logging capabilities, the research team encountered difficulties correlating interactive sign-ins with device creation or WHFB key registration. This technique builds upon previous work by security researcher Dirk-jan Mollema, who demonstrated similar PRT phishing attacks in 2023.
This Cyber News was published on cybersecuritynews.com. Publication date: Thu, 01 May 2025 11:45:08 +0000