Endless Microsoft one-time-use code emails. (forum.uncomfortable.business)

submitted 3 months ago by schizo@forum.uncomfortable.business to c/cybersecurity@sh.itjust.works

11 comments fedilink hide all child comments

I have a question for the hive mind: what is the point of this, exactly?

I mean, I understand the attempt to gain access, and I understand why 2fa codes can be valuable to attempt to phish but that's like, not the thing here.

They just spam dozens to hundreds of these (I'm showing over 400 in my inbox right now) but like, even if I WANTED to give these codes to the attacker, I have no damn clue who the dude in China that's doing this is.

I'm confused as to what they hope to gain by trying over and over and over every couple of hours because it feels like there's no upside to whomever is running this bot, but I probably have missed a memo on some TTP around this, heh.

you are viewing a single comment's thread
view the rest of the comments

[-] driving_crooner@lemmy.eco.br 6 points 3 months ago

Some Microsoft services don't ask for your password anymore, they just send you a code to your register email.

[-] schizo@forum.uncomfortable.business 1 points 3 months ago

Yeah it turns out that's what nonsense this is.

Worse, I sure as crap never opted into this, but at least you can turn it off.

What a stupid decision some product manager made.

[-] slazer2au@lemmy.world -3 points 3 months ago

Passwordless is the best.

[-] Saik0Shinigami@lemmy.saik0.com 8 points 3 months ago

Not when that password is just an email...

[-] Telorand@reddthat.com 2 points 3 months ago

❤️ Passkeys.

this post was submitted on 03 Aug 2024

18 points (95.0% liked)

Cybersecurity

5722 readers

133 users here now

c/cybersecurity is a community centered on the cybersecurity and information security profession. You can come here to discuss news, post something interesting, or just chat with others.

THE RULES

Instance Rules

Be respectful. Everyone should feel welcome here.
No bigotry - including racism, sexism, ableism, homophobia, transphobia, or xenophobia.
No Ads / Spamming.
No pornography.

Community Rules

Idk, keep it semi-professional?
Nothing illegal. We're all ethical here.
Rules will be added/redefined as necessary.

If you ask someone to hack your "friends" socials you're just going to get banned so don't do that.

Learn about hacking

Hack the Box

Try Hack Me

Pico Capture the flag

Other security-related communities !databreaches@lemmy.zip !netsec@lemmy.world !cybersecurity@lemmy.capebreton.social !securitynews@infosec.pub !netsec@links.hackliberty.org !cybersecurity@infosec.pub !pulse_of_truth@infosec.pub

Notable mention to !cybersecuritymemes@lemmy.world

founded 1 year ago

MODERATORS

kid@sh.itjust.works

Lanky_Pomegranate530@midwest.social