Users are prompted to login at the real Microsoft login page, real domain, real cert, and also have MFA enabled. But they've just been phished by a new attack that abuses the OAuth authorization protocol. The attacker is not stopped by the MFA controls and has full access to all of the Microsoft data including Office and Azure. This session will show how to detect and mitigate these phishing attacks.