Watch out - hacking

[Intuneuser31]

Hello,
Yesterday I used this application because I watched some videos and comments. Unfortunately, my tenant has been compromised. Someone watched the admin accounts and changed the phone number information to recover the account. Then, changed the admin accounts password. My problem has been resolved with external help.
I do not recommend this application.
Thank you,

[Micke-K]

Hello,

Not sure what you mean or how this would even work.

This has been used by many around the world for many years and never been reported as a security issue. Only 2 DLLs in the solution and both signed by Microsoft with the original links in the documentation. The rest is full readable PowerShell code. So I don't understand how you can blame the tool for this. Happy to help troubleshooting your issue and what happen because I'm always interested to understand the cause and any security concerns.

Cheers!

[Intuneuser31]

Hello,
I presume problem was the authorisations that we have to give to the application to work. We deleted the aplication at Azure Portal as soon as we watched it, so I am sorry but I have no more records of it. We have look at the Audit log and other records to see what happened with our admin accounts.
Thanks for your response.

[Micke-K]

Hello,

The script uses the MS Graph App with ID, 14d82eec-204b-4c2f-b7e8-296a70dab67e by default. This will have no permissions unless you request consent in the App, added them manually in the Entra portal or did a consent in the MS Graph PS module. The app audit logs should say what app was used for login. And if you have MS Graph logging enabled, you should be able to see when the phone number was changed.

The script will not create and add permissions unless you do the consent.

You can create your own Entra app with specific permissions as well.

Cheers!