1. A sign-in page looks exactly like Microsoft 365 and even asks for your MFA code. Can it still be fake?
Answer: Yes — it can relay everything to the real site. Adversary-in-the-middle kits sit between you and the real login, pass on your code and steal the session cookie.
2. Tycoon 2FA, a kit for fake Microsoft and Gmail pages, was sold on Telegram. Starting price?
Answer: About USD 120 for ten days. Phishing-as-a-service makes MFA-stealing pages cheap enough for anyone (Sekoia, 2024).
3. One phishing kit shows a Gmail page to Gmail users and an Outlook page to Outlook users. How does it know?
Answer: It looks up your email domain’s mail server. Morphing Meerkat checks your domain’s MX record, then serves the matching login page and language (Infoblox, 2025).
4. A page says “verify you’re human”: press Windows+R, paste, and hit Enter. This is:
Answer: A ClickFix attack that runs malware. No real CAPTCHA asks you to run a command. Microsoft saw this behind fake Booking.com pages, installing info-stealers.
5. A fake Teams invite asks you to enter a code at microsoft.com/devicelogin. The page is real. Is it safe?
Answer: No — you’re authorising the attacker’s device. Device-code phishing uses the real Microsoft page. The code you type logs in the attacker. Storm-2372 used it from 2024 (Microsoft).
6. An email with no links, only a QR code to “review the document.” Why use a QR code?
Answer: Scanning moves you to your phone, away from work filters. Quishing hides the link from email scanners and opens it on a device with fewer protections.
7. The link in a phishing email includes your own name or your company’s. That suggests:
Answer: A targeted lure, built to look tailored. Personalised links and file names make lures feel expected. RaccoonO365 named files after HR and finance documents.
8. A login page is hosted on a big trusted cloud service. That means:
Answer: Nothing about whether the page is honest. Attackers host pages on trusted platforms such as Cloudflare R2 so filters and people trust the address.
9. RaccoonO365 let one subscriber target how many addresses a day?
Answer: Up to about 9,000. Microsoft said subscribers could enter up to 9,000 target addresses per day before it and Cloudflare disrupted the service in September 2025.
10. The strongest protection against stolen-session phishing is:
Answer: Phishing-resistant sign-in such as passkeys. Passkeys and security keys only work on the real site, so a proxy page gets nothing it can reuse.