Microsoft’s Honeypot Tactic: Luring Phishers into Fake Azure Tenants

Microsoft is employing a novel strategy to combat phishing by creating convincing honeypots in the form of fake Azure tenants to lure cybercriminals and gather data on their activities. With the intelligence gathered, the company can map out malicious infrastructures, gain deeper insights into phishing operations, and significantly hinder their activity.

The technology and its impact on reducing phishing activities were presented at the BSides Exeter conference by Ross Bevington, Microsoft’s Lead Security Engineer. Bevington described the approach as a “high-interaction hybrid trap,” designed to gather intelligence on cyberattacks. The bait has exposed both inexperienced hackers and state-sponsored groups.

The core of the method lies in Microsoft creating fake tenant environments that include domain names, thousands of accounts, and simulated user activity, making them resemble legitimate corporate systems. Unlike traditional methods, where the trap passively waits for attackers to discover it, Microsoft actively deploys these credentials on phishing sites identified by Defender.

Since the credentials are not protected by two-factor authentication (2FA) and appear genuine, attackers swiftly gain access to them. However, in reality, the hackers are merely wasting their time exploring a decoy environment, unaware that they have fallen into a trap.

Microsoft tracks approximately 25,000 phishing sites daily, with fake credentials being introduced on 20% of them. Once cybercriminals enter the traps, detailed logging of their actions begins, allowing Microsoft to study hacking techniques and gather valuable information such as IP addresses, browsers, locations, and behavioral patterns.

One key element of the method is the deliberate slowing down of system responses, ensuring that hackers spend as much time as possible analyzing the false environment. On average, attackers spend around 30 days before realizing they have been working in a deceptive setting. During this time, Microsoft collects invaluable data that can be used to enhance security measures and create more precise threat profiles.

Bevington highlighted that only about 10% of the IP addresses collected in this manner can be matched to known threat databases. However, the accumulated data already allows for linking attacks to specific groups, including financially motivated criminals and government-backed hackers.