MicrosoftHas anyone tried this approach of using a custom CSS template in Microsoft Entra ID Company Branding, to trigger a logic that detects when a user visited a Microsoft login page via an AitM site / proxy ?
The process is explained here:
https://hybridbrothers.com/aitm-detection-via-css/
But was inspired by https://github.com/HuskyHacks/clarion?tab=readme-ov-file&ref=hybridbrothers.com, which was inspired by https://zolder.io/using-honeytokens-to-detect-aitm-phishing-attacks-on-your-microsoft-365-tenant/
Wondering what were the challenges of testing and implementing this ? and if anyone have successfully detected attacks using this method?
