Detections: AiTM, Device-Code Phishing and App Takeover
Fluency has released new behavior rules for Microsoft Entra ID and Microsoft 365 that detect three campaigns reported by Microsoft Threat Intelligence: adversary-in-the-middle session theft, device-code phishing, and takeover of whole tenants through a registered app.
The rules rolled out October 18–20, 2026 and reach every instance automatically. No configuration is needed.