--- title: "Phishing Proxy Attacks On Microsoft 365: How Attackers Target Cloud Authentication Sessions | Phish Protection" description: "Phishing proxy attacks can bypass MFA and hijack Microsoft 365 authentication sessions. Learn how they work and how to strengthen cloud security." image: "https://phishprotection.com/og/blog/phishing-proxy-attacks-microsoft-365-cloud-authentication-session-security-protection.png" canonical: "https://phishprotection.com/blog/phishing-proxy-attacks-microsoft-365-cloud-authentication-session-security-protection/" --- Quick Answer Phishing proxy attacks target Microsoft 365 by intercepting authentication sessions and stealing credentials or session cookies. Organizations can reduce risks with phishing-resistant MFA, conditional access, session controls, and continuous identity monitoring. Share [ ](https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Fphishprotection.com%2Fblog%2Fphishing-proxy-attacks-microsoft-365-cloud-authentication-session-security-protection%2F "Share on LinkedIn") [ ](https://twitter.com/intent/tweet?text=Phishing%20Proxy%20Attacks%20On%20Microsoft%20365%3A%20How%20Attackers%20Target%20Cloud%20Authentication%20Sessions&url=https%3A%2F%2Fphishprotection.com%2Fblog%2Fphishing-proxy-attacks-microsoft-365-cloud-authentication-session-security-protection%2F "Share on X/Twitter") [ ](https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Fphishprotection.com%2Fblog%2Fphishing-proxy-attacks-microsoft-365-cloud-authentication-session-security-protection%2F "Share on Facebook") [ ](https://reddit.com/submit?url=https%3A%2F%2Fphishprotection.com%2Fblog%2Fphishing-proxy-attacks-microsoft-365-cloud-authentication-session-security-protection%2F&title=Phishing%20Proxy%20Attacks%20On%20Microsoft%20365%3A%20How%20Attackers%20Target%20Cloud%20Authentication%20Sessions "Share on Reddit") [ ](mailto:?subject=Phishing%20Proxy%20Attacks%20On%20Microsoft%20365%3A%20How%20Attackers%20Target%20Cloud%20Authentication%20Sessions&body=Check out this article: https%3A%2F%2Fphishprotection.com%2Fblog%2Fphishing-proxy-attacks-microsoft-365-cloud-authentication-session-security-protection%2F "Share via Email") ![Phishing Proxy Attacks](https://media.mailhop.org/phishprotection/phishing-definition-4963-1788439617275.jpg) Phishing proxy attacks are an evolving approach that cybercriminals use to compromise cloud accounts. Rather than just stealing passwords, these attackers can intercept genuine authentication processes in real time to acquire credentials, [multi-factor authentication](https://www.onelogin.com/learn/what-is-mfa/) (MFA) responses, and session cookies. For businesses that utilize Microsoft 365, this poses a significant threat, as gaining control over a single session can grant access to emails, documents, collaboration platforms, and integrated apps. It’s crucial to comprehend the mechanics of these man-in-the-middle attacks, as well as strategies for detecting and thwarting session theft, to safeguard contemporary cloud identities and strengthen [phishing protection](https://phishprotection.com/). ## What Phishing Proxy Attacks Are and Why Microsoft 365 Is a Prime Target A phishing proxy attack is a modern credential theft technique in which attackers place a reverse proxy between the user and a legitimate identity provider such as Microsoft, Okta, Google, Apple, GitHub, DocuSign, or Adobe. Unlike a basic fake login page, a phishing proxy relays the real authentication **experience to the victim in real time**, making the interaction look authentic while capturing credentials, MFA responses, and session artifacts. _This model is often described as an adversary-in-the-middle attack, or AiTM, because the attacker positions infrastructure between the user and the legitimate cloud service_. It is also a form of man-in-the-middle attack, but adapted for modern cloud identity and browser-based authentication flows. Microsoft 365 is a prime target because it centralizes email, files, collaboration, and identity. A compromised Microsoft 365 account can expose [Exchange Online](https://www.uscloud.com/microsoft-support-glossary/exchange-online/), SharePoint, OneDrive, Teams, and connected SaaS applications through single sign-on and SSO. For threat actors, one successful phishing proxy login can become an entry point for **business email compromise**, data exfiltration, and broader enterprise intrusion. ![AiTM Authentication Relay Flow](https://media.mailhop.org/phishprotection/what-is-phishing-7358-1788439662783.jpg) ### Evil Proxy, VoidProxy, and the PhaaS Economy Tools and services such as EvilProxy, evilginx2, and VoidProxy have made phishing-as-a-service more accessible. In the PhaaS model, operators sell ready-made phishing kits, hosting, templates, dashboards, and support. An evil proxy platform may provide prebuilt lures for Microsoft 365, Okta, Google Workspace, Concur Solutions, JFrog, DocuSign, Adobe, and GitHub. VoidProxy is often discussed as part of this broader phishing-as-a-service ecosystem, where branded login experiences and automation lower the barrier for attackers. A voidproxy campaign may use a reverse proxy to relay Microsoft authentication pages while harvesting session tokens. Similarly, an evil proxy service may **support cookie injection**, session replay workflows, and infrastructure rotation. #### Why Cloud Authentication Sessions Are Valuable Modern identity systems rely heavily on browser sessions. Once a user authenticates, the browser receives session cookies and tokens that prove the user has completed the login process. If attackers obtain those session tokens, they may perform session hijacking without needing to repeatedly enter the password or respond to MFA. That is why phishing proxy, evil proxy, and **voidproxy attacks focus** less on stealing only passwords and more on stealing active [cloud authentication](https://www.cybereason.com/blog/cloud-authentication-a-guide-to-choosing-the-right-solution) sessions. ## How Attackers Intercept Credentials, MFA Prompts, and Session Tokens In an adversary-in-the-middle setup, the victim enters credentials into what appears to be Microsoft’s legitimate sign-in flow. Behind the scenes, the reverse proxy forwards the traffic to Microsoft while observing the authentication exchange. This is the key difference between a static phishing site and a live phishing proxy. ![Session Token Targeting](https://media.mailhop.org/phishprotection/what-is-a-zero-day-attack-8521-1788439692885.jpg) ### MFA Bypass Through Real-Time Relay Traditional user training often warns employees not to enter passwords into suspicious pages. But [AiTM attacks](https://www.futurismtechnologies.com/news/microsoft-warns-of-increased-aitm-phishing-attacks/) are more convincing because the user may see **real Microsoft branding**, legitimate MFA prompts, and familiar Authenticator App approval workflows. _The attacker can intercept the username and password, then relay the MFA challenge_. If the user approves the push notification or enters a one-time code, the attacker captures the resulting authenticated session. This enables multi-factor authentication bypass, MFA bypass, and, in some cases, 2FA bypass without technically breaking MFA cryptography. #### Cookie Injection and Session Replay Risk Once authenticated, the attacker may capture session cookies and reuse them to access Microsoft 365\. This is where cookie injection becomes relevant: stolen session material can be inserted into an **attacker-controlled browser environment** to impersonate the victim’s authenticated state. Defensive teams should understand cookie injection as a session abuse technique tied to session replays, not merely password theft. A man-in-the-middle attack of this kind can bypass many controls that only check whether MFA was completed. If the attacker has the session after successful authentication, the identity platform may treat the activity as valid unless additional [conditional access](https://cwsisecurity.com/what-is-conditional-access/), device trust, or risk-based controls intervene. ### Malicious Infrastructure and Anti-Analysis A typical PhaaS operation may use a malicious proxy server, dynamic DNS, compromised infrastructure, or Cloudflare Workers to host redirectors and obscure origin servers. Some phishing-as-a-service kits **include anti-analysis features** that block security scanners, sandbox environments, or known IP ranges used by vendors. ![Phishing-as-a-Service Features](https://media.mailhop.org/phishprotection/how-to-prevent-phishing-7327-1788439725429.jpg) Security teams may see suspicious redirects across [malicious domains](https://www.techradar.com/pro/security/over-5-000-malicious-domains-targeting-2026-us-midterm-elections-spotted-going-live-and-they-could-be-used-for-fraud-phishing-or-worse), odd user agents, or abnormal authentication endpoints in Web Traffic Logs and organizational network traffic. Sources such as AlienVault OTX, vendor research, and Okta Threat Intelligence can help enrich indicators of compromise and related IoCs. ## Common Attack Flow: From Deceptive Email to Cloud Account Takeover A Microsoft 365 phishing campaign often begins with an email that appears to come from a trusted service: a shared file notification, **DocuSign request**, Adobe document, GitHub alert, Microsoft Teams message, or finance workflow from Concur Solutions. ### Step 1: Delivery Through Email _The message may pass through an email gateway if the sender domain is newly registered, lightly reputationed, or routed through legitimate cloud services_. Attackers frequently tune wording, branding, and links to evade [email security](https://phishprotection.com/practices-for-email-security-learning-implementing-protecting/) filters. #### Step 2: Redirect to a Fake Login Page The user clicks a link and lands on a fake login page or **redirect chain controlled** by an evil proxy service. In more advanced cases, the visible page is not simply fake; it is a proxied version of the real Microsoft login flow. This is where phishing proxy tactics differ from older [credential harvesting](https://www.rescana.com/post/fortibleed-credential-harvesting-campaign-active-exploitation-of-fortigate-firewalls-compromises-over-110-million-creden) pages. ### Step 3: AiTM Authentication Relay The AiTM system forwards the victim’s input to Microsoft while capturing credentials and session data. A voidproxy or EvilProxy operation may support multiple tenants and templates, giving threat actors a turnkey phishing-as-a-service platform. This is a live man-in-the-middle attack against cloud authentication flows. If the victim completes MFA, the **adversary-in-the-middle infrastructure** may receive authenticated session material. ![Blast Radius of Compromise](https://media.mailhop.org/phishprotection/phishing-prevention-5683-1788439801358.jpg) #### Step 4: Account Access and Persistence After the session is captured, attackers may access Outlook, OneDrive, SharePoint, or admin portals depending on the user’s privileges. They may create inbox rules, register new devices, add OAuth grants, or attempt privilege access escalation. If Microsoft Intune or device compliance checks are weak, the attacker may maintain access longer. ## Business Impact: Data Theft, BEC, Lateral Movement, and Persistence The business consequences of phishing proxy attacks are serious because Microsoft 365 often **holds sensitive communications**, contracts, invoices, intellectual property, and identity-connected SaaS access. ### Business Email Compromise and Fraud A successful [Business Email Compromise](https://www.cisco.com/site/us/en/learn/topics/security/what-is-business-email-compromise-bec.html) incident, or BEC, may begin with one stolen session. Attackers can monitor executive mailboxes, hijack invoice threads, alter payment instructions, or impersonate employees and vendors. Since the attacker may be operating from an authenticated session, the activity can appear less suspicious than a simple failed login storm. ### Data Exfiltration and SaaS Pivoting With valid Microsoft 365 access, threat actors may **download SharePoint libraries**, search mailboxes for financial records, or extract files from OneDrive. They may also pivot into connected applications through Single Sign-On Providers, including Okta-managed apps, Google services, GitHub repositories, Adobe assets, DocuSign envelopes, or JFrog artifact repositories. ![Defensive Controls Matrix](https://media.mailhop.org/phishprotection/phishing-prevention-tips-7246-1788439834189.jpg) #### Lateral Movement and Identity Abuse _Once inside, attackers may pursue lateral movement by identifying privileged users, shared mailboxes, service accounts, or weak group memberships_. Poor identity management, excessive access, and failure to apply the least privilege principle amplify the blast radius. A PhaaS operator using voidproxy, evil proxy, or another reverse proxy kit may not need malware at all. Instead, **they abuse identity**, browser trust, and cloud sessions. ## Defenses and Detection Strategies for Protecting Microsoft 365 Authentication Sessions Effective defense requires layered security controls across identity, email, endpoint, network, and cloud telemetry. ### Strengthen Identity and Conditional Access Organizations should enforce conditional access policies that evaluate device compliance, location risk, sign-in risk, and **application sensitivity**. Microsoft 365 environments integrated with Microsoft Intune can require managed, compliant devices before granting access to high-value resources. [Phishing-resistant](https://phishprotection.com/blog/what-is-phishing-resistant-mfa-why-passwords-are-not-enough/) authentication is critical. Hardware-backed passkeys, FIDO2 security keys, certificate-based authentication, and device-bound methods such as Okta FastPass and FastPass can reduce exposure to adversary-in-the-middle attacks. Properly deployed Okta FastPass can make session theft harder by binding authentication to trusted devices rather than reusable secrets. #### Reduce Session Abuse Shorter session lifetimes, **continuous access evaluation**, token protection, and reauthentication for sensitive actions help limit damage from stolen sessions. Controls should specifically address cookie injection, because a valid stolen cookie can be more useful to an attacker than a password. ### Improve Detection Across Email, Identity, and Network Telemetry Detection should combine signals from Microsoft Entra ID logs, Microsoft 365 [audit logs](https://www.sumologic.com/glossary/audit-log), Email Gateway events, Web Traffic Logs, EDR telemetry, and Cloud Platform data. A mature SOC can correlate these events in a SIEM, automate enrichment with SOAR, and investigate suspicious devices through EDR. ![Understanding Phishing Proxy MFA Bypass](https://media.mailhop.org/phishprotection/phishing-prevention-best-practices-6328-1788439862508.jpg) #### Key Detection Signals Look for impossible travel, unfamiliar session reuse, new inbox rules, suspicious OAuth consent, anomalous user agents, unusual ASN changes, and **access from hosting providers**. Authentication request monitoring can identify odd MFA patterns, repeated prompts, and sign-ins that originate from suspicious proxy infrastructure. Threat detection teams should also monitor for malicious domains, dynamic DNS, Cloudflare abuse patterns, and known phishing-as-a-service infrastructure. Threat intelligence from Microsoft, Okta [Threat Intelligence](https://cybersecurityventures.com/recorded-future-the-worlds-largest-pure-play-threat-intelligence-company/), AlienVault OTX, internal detections, and a dedicated Threat Analysis Team can help identify IoCs tied to VoidProxy, EvilProxy, evilginx2, and other PhaaS kits. ### Identity Threat Hunting and User Resilience Identity threat hunting should focus on abnormal access patterns after successful MFA, not only failed logins. Analysts can use Python scripts, SIEM queries, and **Microsoft Graph data** to identify suspicious mailbox rules, risky OAuth applications, and session anomalies. #### Training and Response Readiness _User awareness training remains important, but it must evolve_. Employees should understand that a convincing Microsoft 365 prompt can still be part of an AiTM or man-in-the-middle attack. Response playbooks should include token revocation, password reset, device review, mailbox rule removal, OAuth grant cleanup, and investigation for Business Email Compromise activity. ![Brad Slavin](https://media.mailhop.org/phishprotection/images/authors/brad-slavin.jpg) [ Brad Slavin ](/authors/brad-slavin/) General Manager Founder and General Manager of DuoCircle. Product strategy and commercial lead across DuoCircle's 2,000+ customer base. [LinkedIn Profile →](https://www.linkedin.com/in/bradslavin) ## Protect your inbox from phishing attacks Real-time email security with 60-day free trial. No credit card required. [Start Free Trial](https://portal.duocircle.com/cart.php?a=add&pid=101&brand=phishprotection) [View Pricing](/pricing/) Share this article [ ](https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Fphishprotection.com%2Fblog%2Fphishing-proxy-attacks-microsoft-365-cloud-authentication-session-security-protection%2F) [ ](https://twitter.com/intent/tweet?text=Phishing%20Proxy%20Attacks%20On%20Microsoft%20365%3A%20How%20Attackers%20Target%20Cloud%20Authentication%20Sessions&url=https%3A%2F%2Fphishprotection.com%2Fblog%2Fphishing-proxy-attacks-microsoft-365-cloud-authentication-session-security-protection%2F) [ ](https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Fphishprotection.com%2Fblog%2Fphishing-proxy-attacks-microsoft-365-cloud-authentication-session-security-protection%2F) Copy Related Articles - [ 4 Common Cyber Threats That Your Business May Face In 2022 Advanced ](/blog/4-common-cyber-threats-business-face-2022/) - [ ![Phish Protection blog post image](https://media.mailhop.org/phishprotection/images/2018/08/phishing-prevention-tips-2682.jpg) Can Phishing Awareness Training Cause More Harm Than Good? Advanced ](/blog/can-phishing-awareness-training-cause-more-harm-than-good/) - [ ![Anti-phishing protection](https://media.mailhop.org/phishprotection/images/wp/2022/04/anti-phishing-protection-0895.jpg) The Credential Stuffing Counter-Measure: How Proxies Help Detect Bot-Led Login Attacks Advanced ](/blog/credential-stuffing-countermeasure-proxies-detect-bot-led-login-attacks-effectively/) - [ ![Ghost phishing hides the attack until the page renders in the browser](https://media.mailhop.org/phishprotection/images/2026/01/protection-from-phishing-5275.jpg) Ghost Phishing: Why a Clean URL Scan No Longer Means a Clean Page Advanced ](/blog/ghost-phishing-when-a-clean-url-scan-doesnt-mean-a-clean-page/) ## Related Articles [ Advanced 7m 4 Common Cyber Threats That Your Business May Face In 2022 Sep 9, 2022 ](/blog/4-common-cyber-threats-business-face-2022/)[ Advanced 4m Can Phishing Awareness Training Cause More Harm Than Good? Aug 8, 2018 ](/blog/can-phishing-awareness-training-cause-more-harm-than-good/)[ Advanced 3m The Credential Stuffing Counter-Measure: How Proxies Help Detect Bot-Led Login Attacks Feb 6, 2026 ](/blog/credential-stuffing-countermeasure-proxies-detect-bot-led-login-attacks-effectively/)[ Advanced 9m Ghost Phishing: Why a Clean URL Scan No Longer Means a Clean Page Jul 8, 2026 ](/blog/ghost-phishing-when-a-clean-url-scan-doesnt-mean-a-clean-page/) ```json {"@context":"https://schema.org","@type":"Organization","name":"Phish Protection","url":"https://phishprotection.com","logo":{"@type":"ImageObject","url":"https://phishprotection.com/images/phishprotection-logo.png"},"description":"Advanced phishing protection and email security for businesses. Real-time threat defense, time-of-click protection, and seamless Office 365 integration.","parentOrganization":{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138883901","name":"DuoCircle LLC","url":"https://www.duocircle.com","sameAs":["https://www.wikidata.org/wiki/Q138883901","https://www.crunchbase.com/organization/duocircle-llc","https://www.linkedin.com/company/duocircle","https://github.com/duocircle"],"subOrganization":[{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897912","name":"Phish Protection","url":"https://www.phishprotection.com"}]},"sameAs":["https://www.linkedin.com/company/duocircle","https://x.com/duocirclellc","https://www.facebook.com/duocirclellc","https://github.com/duocircle"],"contactPoint":{"@type":"ContactPoint","contactType":"customer support","url":"https://phishprotection.com/contact/"},"knowsAbout":["Phishing Protection","Email Security","Anti-Phishing","Business Email Compromise","Ransomware Protection","Time of Click Protection","Office 365 Email Security","Advanced Threat Defense"]} ``` ```json {"@context":"https://schema.org","@type":"WebSite","name":"Phish Protection","url":"https://phishprotection.com","description":"Advanced phishing protection and email security for businesses. Real-time threat defense, time-of-click protection, and seamless Office 365 integration.","publisher":{"@type":"Organization","name":"Phish Protection","url":"https://phishprotection.com","logo":{"@type":"ImageObject","url":"https://phishprotection.com/images/phishprotection-logo.png"},"description":"Advanced phishing protection and email security for businesses. Real-time threat defense, time-of-click protection, and seamless Office 365 integration.","parentOrganization":{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138883901","name":"DuoCircle LLC","url":"https://www.duocircle.com","sameAs":["https://www.wikidata.org/wiki/Q138883901","https://www.crunchbase.com/organization/duocircle-llc","https://www.linkedin.com/company/duocircle","https://github.com/duocircle"],"subOrganization":[{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897912","name":"Phish Protection","url":"https://www.phishprotection.com"}]}}} ``` ```json {"@context":"https://schema.org","@type":"BlogPosting","headline":"Phishing Proxy Attacks On Microsoft 365: How Attackers Target Cloud Authentication Sessions","description":"Phishing proxy attacks can bypass MFA and hijack Microsoft 365 authentication sessions. Learn how they work and how to strengthen cloud security.","url":"https://phishprotection.com/blog/phishing-proxy-attacks-microsoft-365-cloud-authentication-session-security-protection/","datePublished":"2026-09-03T00:00:00.000Z","dateModified":"2026-09-03T00:00:00.000Z","dateCreated":"2026-09-03T00:00:00.000Z","author":{"@type":"Person","@id":"https://phishprotection.com/authors/brad-slavin/#person","name":"Brad Slavin","url":"https://phishprotection.com/authors/brad-slavin/","jobTitle":"General Manager","description":"Brad Slavin is the founder and General Manager of DuoCircle, the company behind DMARC Report, AutoSPF, Phish Protection, and Mailhop. He founded DuoCircle in 2014 and has led the company's growth to 2,000+ customers across its email security product family. Brad's focus is product strategy, customer relationships, and the commercial and compliance side of email authentication (DPAs, SLAs, enterprise procurement).","image":"https://media.mailhop.org/phishprotection/images/authors/brad-slavin.jpg","knowsAbout":["Email Security Strategy","SaaS Product Management","Enterprise Compliance","Customer Success","Email Deliverability Business"],"worksFor":{"@type":"Organization","name":"Phish Protection","url":"https://phishprotection.com"},"sameAs":["https://www.linkedin.com/in/bradslavin"]},"publisher":{"@type":"Organization","name":"Phish Protection","url":"https://phishprotection.com","logo":{"@type":"ImageObject","url":"https://phishprotection.com/images/phishprotection-logo.png"},"description":"Advanced phishing protection and email security for businesses. Real-time threat defense, time-of-click protection, and seamless Office 365 integration.","parentOrganization":{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138883901","name":"DuoCircle LLC","url":"https://www.duocircle.com","sameAs":["https://www.wikidata.org/wiki/Q138883901","https://www.crunchbase.com/organization/duocircle-llc","https://www.linkedin.com/company/duocircle","https://github.com/duocircle"],"subOrganization":[{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897912","name":"Phish Protection","url":"https://www.phishprotection.com"}]},"sameAs":["https://www.linkedin.com/company/duocircle","https://x.com/duocirclellc","https://www.facebook.com/duocirclellc","https://github.com/duocircle"],"contactPoint":{"@type":"ContactPoint","contactType":"customer support","url":"https://phishprotection.com/contact/"},"knowsAbout":["Phishing Protection","Email Security","Anti-Phishing","Business Email Compromise","Ransomware Protection","Time of Click Protection","Office 365 Email Security","Advanced Threat Defense"]},"mainEntityOfPage":{"@type":"WebPage","@id":"https://phishprotection.com/blog/phishing-proxy-attacks-microsoft-365-cloud-authentication-session-security-protection/"},"articleSection":"advanced","keywords":"","image":{"@type":"ImageObject","url":"https://media.mailhop.org/phishprotection/phishing-definition-4963-1788439617275.jpg","caption":"Phishing Proxy Attacks"},"speakable":{"@type":"SpeakableSpecification","cssSelector":[".answer-block","h1"]}} ``` ```json {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://phishprotection.com/"},{"@type":"ListItem","position":2,"name":"Blog","item":"https://phishprotection.com/blog/"},{"@type":"ListItem","position":3,"name":"Advanced","item":"https://phishprotection.com/advanced/"},{"@type":"ListItem","position":4,"name":"Phishing Proxy Attacks On Microsoft 365: How Attackers Target Cloud Authentication Sessions","item":"https://phishprotection.com/blog/phishing-proxy-attacks-microsoft-365-cloud-authentication-session-security-protection/"}]} ```