Freelance Cybersecurity Specialists in United StatesFreelance Cybersecurity Specialists in United States
ProjectsPeople
Watheq Zboun's avatar
Watheq Zboun
maxUnited States
Microsoft 365 & Azure Solutions Architect
$5k+
Earned
2x
Hired
5.0
Rating
14
Followers
Microsoft 365 & Azure Solutions Architect
Cover image for Have you wondered how hacekrs
Have you wondered how hacekrs bypass MFA? Nowadays it is getting easier. There is a phishing kit called Mirage2FA that has been working against Microsoft 365 since late 2024. Here is how it goes. The user lands on a fake login page. They type their password. They approve the MFA prompt on their phone. Everything they enter is passed straight through to Microsoft in real time, so the sign-in genuinely succeeds and looks completely normal to them. Microsoft issues the session tokens, and the kit keeps a copy. With those cookies someone can read the mailbox, open SharePoint and OneDrive, and reach anything sitting behind SSO. They never see a second prompt, because the authentication already happened. ANY.RUN (http://ANY.RUN) put numbers on it. 9,426 accounts targeted across 3,518 domains, roughly 4,532 showing signs of compromise, most of them in the US. A third of the successful logins happened on phones, where you can barely see the URL you are looking at. The advice going around is to switch on Continuous Access Evaluation. I would switch it on too. Just read the documentation first, because it does something slightly different to what people assume. CAE sessions run tokens for up to 28 hours. The default is one hour. What you get in exchange is revocation when something happens, and Microsoft is specific about what counts: the account is disabled or deleted, the password is changed or reset, MFA gets turned on, an admin revokes refresh tokens, or ID Protection flags the user as high risk. Allow up to 15 minutes for that to propagate. IP location is the only one that applies straight away. Three things worth knowing before you lean on it. It covers Exchange Online, SharePoint Online and Teams. Guest accounts are not supported, which is where a lot of contractor access lives. And it only reads IP-based named locations, so a country-based policy buys you nothing here. If I were fixing this in a tenant tomorrow, in this order: Phishing-resistant sign-in first. A FIDO2 key checks the domain it is talking to, so it will not hand anything over to a proxy wearing Microsoft's face. CAE on, so revocation actually reaches the services. Then a runbook where you revoke sessions before you reset the password. Reset first and you have changed the lock while someone is still inside holding a key that works. If session cookies walked out of your tenant this morning, what would notice, and how long would it take? Source: ANY.RUN (http://ANY.RUN) threat research, 19 August 2026. CAE behaviour from Microsoft Learn.
1
1
66
Cover image for Did you know that cybercrime
Did you know that cybercrime is projected to cost the world $10.5 TRILLION a year. What is the average data breach in the US? $10.22 million which is at a record high. Here is my question to people here, if you could only strengthen 3 out of these 12 cybersecurity pillars, which would you pick? Disaster Recovery Authentication Authorization Encryption Vulnerability Management Audit & Compliance Network Security Endpoint Security Incident Response Container Security API Security Third-Party Management I would argue Authentication, Incident Response, and Third-Party Management, because the data shows 53% of breaches start with stolen credentials, and vendor compromises are surging.
0
198
Cover image for GoDaddy Move-Away That Uncovered a Data Residency Problem
GoDaddy Move-Away That Uncovered a Data Residency Problem
0
7
Cover image for Microsoft Security Architecture Diagrams
Microsoft Security Architecture Diagrams
0
6
Cybersecurity Specialist(2)
jesse callistus's avatar
jesse callistus
United States
"Fortifying digital defenses strategically."
"Fortifying digital defenses strategically."
Cover image for Web Application Developer & Security
Web Application Developer & Security
0
6
Cover image for Vulnerability Assessment Services DEMO
Vulnerability Assessment Services DEMO
0
14
Cover image for Pentest Engagements
Pentest Engagements
0
17
Placeholder project card media
View more →
Cybersecurity Specialist(3)
Catherine E's avatar
Catherine E
California, USA
Versatile Writer Specializing in Tech and Security
Versatile Writer Specializing in Tech and Security
Cover image for Clorox Cyberattack Causes Widespread Disruption, Shortages
Clorox Cyberattack Causes Widespread Disruption, Shortages
0
13
Cover image for MOVEit Hack: Over 600 Organizations Impacted, Millions of People
MOVEit Hack: Over 600 Organizations Impacted, Millions of People
0
12
Cover image for EXAMPLE - SOP for Replacing a UPS in an IDF
EXAMPLE - SOP for Replacing a UPS in an IDF
0
29
Placeholder project card media
View more →
Cybersecurity Specialist(2)
Crispine Poe's avatar
Crispine Poe
California, USA
Experienced IT Specialist, Writer, Cybersecurity
Experienced IT Specialist, Writer, Cybersecurity
Cover image for Cybersecurity Risk Assessment for a Financial Institution
Cybersecurity Risk Assessment for a Financial Institution
0
9
Cover image for My approach on securing a client company's systems
My approach on securing a client company's systems
0
9
Cover image for The Rise of Quantum Computing: Unlocking the Future
The Rise of Quantum Computing: Unlocking the Future
0
9
Placeholder project card media
View more →
Cybersecurity Specialist(3)