Agentless CSS Phishing Protection

Threat actors frequently target finance or accounting personnel. Once they gain access, they often send altered invoices to existing customers with fraudulent account details. Depending on the business, the resulting financial and reputational damage can be severe — in some cases, losses have reached up to $100,000 from a single compromised account.

Recent high-value breaches where attackers successfully accessed user accounts include incidents such as The Hague Gemeente fake email campaign and the Dutch police contact details breach. Each of these incidents could have been mitigated by applying the controls discussed here and in our broader Microsoft 365 security baseline.

Regular MFA does not protect against these modern attacks. Threat actors use specially designed proxy servers to record user sessions — including the MFA token — in Adversary-in-the-Middle (AITM) attacks, bypassing what is often considered a secure control.

How to Implement

This solution requires uploading a CSS file to your company’s login branding page in Entra ID. Copy and save the CSS below. Optionally, replace the email address in the URL to receive alerts when phishing detections occur.

Opening the canary URL directly in a browser will not show an image — the protection works when the URL is loaded from CSS during sign-in.

.ext-sign-in-box
{
  background-image: url("https://canary.modernworkplace.services/api/your-email@yourdomain.com");
}

.ext-sign-in-box
{
  background: white url('https://canary.modernworkplace.services/api/your-email@yourdomain.com') center no-repeat;
}

Replace your-email@yourdomain.com with your alert address (URL-encoded if needed).

1. Sign in to the Entra admin centre.
2. Go to Company branding → Default sign-in experience (or your custom branding profile).
3. Open the Layout tab and upload your CSS file. See Microsoft’s branding documentation for details.
4. Save changes. Allow up to 10 minutes for the safe-login indicator to appear on sign-in.

The CSS protection activates each time a user signs into a Microsoft portal. A red background is shown whenever a user visits a phishing website that proxies the login flow.