baseVISION TI – Hijacking Microsoft company accounts via TikTok open redirection abuse is still a thing

In our latest TI report, baseVISION uncovers a phishing campaign that abuses TikTok’s open redirect feature to hijack Microsoft credentials. The attackers use multi-stage redirect chains, IP-based cloaking, and Adversary-in-the-Middle (AiTM) phishing pages to bypass MFA and steal session tokens.

We break down the full attack chain, indicators of compromise, and provide actionable steps to protect your organization.