Many organizations rely on multi-factor authentication (MFA) as a strong defense against account compromise. However, attackers are increasingly using phishing techniques that don’t require stealing passwords or bypassing MFA altogether.
On July 8, 2026, BleepingComputer will host a live webinar titled “Stop chasing alerts: Automating email security with behavioral AI” presented by Dan Nickolaisen, Solutions Architect Manager at Abnormal AI, and Eric Danneker, Director of Cyber Vigilance and Defense at Novant Health. The webinar will examine how modern phishing campaigns, business email compromise (BEC), and account takeover (ATO) attacks exploit trusted services and authentication workflows to gain access to corporate accounts.
One technique receiving growing attention is Device Code phishing, where attackers trick users into authorizing access through legitimate Microsoft authentication pages. Because users complete a real login and MFA challenge, attackers can obtain persistent access without ever stealing credentials.
This shift presents a challenge for security teams. Traditional email defenses, credential monitoring, and MFA protections may not detect these attacks, leaving analysts to investigate suspicious activity only after an account has already been compromised.
Abnormal AI uses behavioral AI to identify unusual account activity, suspicious communications, and attack patterns that conventional security controls may miss. Attendees will learn practical approaches for detecting account compromise earlier, reducing investigation workloads, and improving response times through automation and behavioral analysis.
Why MFA Isn't Stopping Every Account Takeover
Phishing attacks still focus on stealing passwords, but increasingly attackers are targeting authentication workflows themselves. By abusing legitimate authorization processes, attackers can obtain access tokens that grant ongoing access to email, cloud applications, and corporate resources without triggering many traditional security controls.
How Device Code Phishing Works and Why It Bypasses Traditional Credential Theft Protections
Device Code phishing involves tricking users into authorizing access through legitimate Microsoft authentication pages. This allows attackers to obtain persistent access without ever stealing credentials.
The Operational Challenges These Attacks Create for SOC and Incident Response Teams
Traditional email defenses, credential monitoring, and MFA protections may not detect these attacks, leaving analysts to investigate suspicious activity only after an account has already been compromised.
How Behavioral AI Can Identify Suspicious Account Activity and Automate Investigations
Abnormal AI uses behavioral AI to identify unusual account activity, suspicious communications, and attack patterns that conventional security controls may miss. Attendees will learn practical approaches for detecting account compromise earlier, reducing investigation workloads, and improving response times through automation and behavioral analysis.
Conclusion
The webinar on July 8, 2026, will explore how organizations can identify these attacks sooner and use behavioral AI to automate detection and response activities before compromised accounts lead to larger security incidents. Attendees will learn practical approaches for reducing response times and limiting account takeover risks.
Source: Original article