Danilo Silva

As we wait for the next installment of my crazy work life, I wanted to highlight something real quick about someone who asked me how they got hacked on their free Microsoft account with two factor enabled. The answer was that they didn't have an app password set so the hacker used Exchange ActiveSync which uses Basic Authentication to login (Exchange ActiveSync can't use 2FA, and you can't shut off this auth method on a free accountb that I know of, but you can with paid M365 accounts) with their own password despite having two factor. The fix is: Revoke logged in sessions (which can take up to 24 hrs) Change password on another trusted device to rule out compromise Set up an app password. And I'd set up two factor again just to be sure. Now that an app password is set it should not let the hacker back in using this method and should error out on their end.