Incident-Response

It started as a small thing: a reader — well, me, reading my own site — noticed nine days in July with headlines but no “From the Trenches” commentary underneath them. Easy enough to backfill by hand. But backfilling isn’t fixing, and I’ve learned the hard way that a bug you patch around instead of root-causing just shows up again wearing a different date. ...

When most people think about phishing, they picture a fake login page harvesting credentials. Device code phishing doesn’t work that way. There’s no spoofed domain. No credential harvesting. No malware. The victim authenticates against real Microsoft infrastructure, completes their MFA challenge, and hands an attacker a fully valid Bearer token — all without knowing anything unusual happened. ...