Phishing prevention

Stopping credential phishing when ordinary MFA is no longer enough.

Microsoft says password-based attacks are still behind over 99% of the identity attacks it sees, and phishing kits now relay MFA codes and approvals in real time. The fix is layers: sign-in that a fake page cannot capture, email that is checked twice, links checked at the click, and a fast way for staff to report. Here is how each layer works in Microsoft 365, and an 8-point check.

Microsoft figures from Microsoft Learn, citing its 2024 Digital Defense Report.

Talk to an engineer Check your defences 07 3114 2808

Phishing-resistant sign-in
Email checked twice
8-point check

Reviewed by Blake Bath, General Manager, on 30 October 2026.

Over the shoulder of a man at a laptop with an email open and the mouse pointer over a message, a sticky note on the screen edge and colleagues working behind. — **The one that matters most**Passkeys cannot be typed into a fake page.

The layers

Five layers between a phishing email and a stolen account.

No one layer catches everything. Together they make a stolen password, or a stolen code, worth very little.

Sign-in that cannot be phished

Passkeys, Windows Hello and security keys only work with the real site. Codes, SMS and push approvals can be relayed by adversary-in-the-middle kits, which Microsoft says rose 146% in a year.

Admins and remote access first
Authentication strengths in Conditional Access
SMS removed

Phishing defence check

How well would your business hold up to a phishing campaign?

Eight controls that stop credential phishing. Tick what is true today and copy the gaps for your IT provider.

Tick what is true at your business today. The gaps are where a phishing email could become a stolen account.

Phishing-resistant MFA for admins and remote accessPasskeys, Windows Hello or security keys.
A second email check after Microsoft'sIncluding internal email between your own staff.
Links checked when they are clickedSafe Links or your filter's equivalent, in email and Teams.
Impersonation protection configuredFor your executives, finance staff and your own domains.
Device code sign-in blocked unless neededThrough a Conditional Access authentication flows policy.
Staff cannot approve third-party appsAdmin consent only.
A report button, and someone who acts on itReported emails pulled from every inbox the same day.
Payment and account changes confirmed by a known channelA call to a number you already had.

Where you stand

0of 8 controls in place

8 gaps to close.

Phishing-resistant MFA for admins and remote accessA fake sign-in page cannot capture a passkey. It can capture a code or an approval.
A second email check after Microsoft'sPhishing increasingly comes from real, hijacked accounts that pass basic checks.
Links checked when they are clickedA link can be clean when delivered and malicious an hour later.
Impersonation protection configuredMicrosoft's default anti-phishing policy does not turn impersonation protection on.
Device code sign-in blocked unless neededDevice code phishing gets people to sign an attacker in on a genuine Microsoft page. ISM-2140 now says block it.
Staff cannot approve third-party appsConsent phishing grants an attacker's app access without stealing a password.
A report button, and someone who acts on itOne report can protect everyone who received the same email.
Payment and account changes confirmed by a known channelISM-2126 now asks for this, because voices and video can be faked.

Talk to an engineer

Our view

We tune the filters ourselves, and we still plan for one getting through.

Real Bytes' own email runs on custom Defender for Office 365 policies plus Check Point, with Microsoft's preset policies switched off, so someone owns every rule. Check Point is part of every client managed plan too.

But filters miss things, and the most damaging phish now comes from a real supplier's hijacked mailbox. So the layer we push hardest is sign-in: once admins and remote access are on passkeys or security keys, a perfect fake sign-in page captures nothing useful.

How credential phishing works now

Four kinds of phishing, and what stops each.

Attack	What happens	What stops it
Fake sign-in page	A password and code are typed into a copy of the Microsoft page	Phishing-resistant MFA, link checking
Adversary in the middle	The fake page relays the real sign-in and steals the session token	Passkeys or security keys; device and risk-based Conditional Access
Device code phishing	The user enters a code on the real Microsoft page and signs the attacker in	Block device code flow
Consent phishing	The user approves an attacker's app, which gets access to mail or files	Admin-only app consent and consent reviews

The Australian guidance

What ASD says.

ASD's business email compromise guidance calls for MFA, payment verification by a known channel, email authentication and staff training. Its September 2026 ISM adds controls for confirming requests through a trusted channel (ISM-2126) and blocking device code sign-in (ISM-2140).

Mistakes we see

Five gaps phishing gets through.

MFA by text or push and nothing elseRelayed in real time by phishing kits.
Impersonation protection never set upNot on in Microsoft's default anti-phishing policy.
Users allowed to approve appsConsent phishing needs no password.
Password reset without revoking sessionsA stolen token keeps working.
No one watching reportsStaff stop reporting when nothing happens.

How we harden a tenant

Phishing protection in five steps.

Step 1Review
Sign-in methods, filtering, app consent and recent phishing reports.
Step 2Lock sign-in
Phishing-resistant MFA for admins, device code flow blocked, consent admin-only.
Step 3Filter
Check Point and tuned Defender for Office 365 policies, including impersonation protection.
Step 4Train and report
Report button, practice emails and a same-day response.
Step 5Watch
Risky sign-ins and hijacked-account alerts acted on.

Related services

Phishing is stopped in layers. These are the layers.

Email filtering, sign-in, domain protection and people, together.

Get help your way

Six ways to reach us. Pick whichever suits you.

Helpdesk hours are Monday to Friday, 8am to 5pm AEST. On Advantage and above, emergencies get a response within 1 hour and outages within 2, with 24/7 best-effort escalation.

Questions

What people ask about phishing prevention.

What stops credential phishing best?

Phishing-resistant sign-in. A passkey, Windows Hello or a security key only works with the real site, so a fake page has nothing to capture. Codes and push approvals can be relayed by adversary-in-the-middle phishing kits.

Does Microsoft 365 already stop phishing?

It stops a lot. With Defender for Office 365, the Built-in protection preset applies Safe Links and Safe Attachments, and anti-spoofing is on by default. Impersonation protection is not on in the default anti-phishing policy and has to be configured.

What is adversary-in-the-middle phishing?

The attacker's page sits between the user and the real Microsoft sign-in, passes the MFA prompt through, and steals the session token. Microsoft reported a 146% rise in these attacks in its 2024 Digital Defense Report.

Is phishing training worth it?

Yes, as one layer. ASD lists awareness training among its business email compromise defences. Training works best when reporting is easy and staff see that reports are acted on.

Someone entered their password on a fake page. What now?

Reset the password, revoke their sessions so any stolen token stops working, check for new mail rules and app consents, and look at sign-ins since the click. Real Bytes clients, call us on 07 3114 2808.

Next step