![](\"https:\/\/ci3.googleusercontent.com\/meips\/ADKq_Nb1aXnYhiG0zoJ7R2kXL-5cJbav4PI2iP1dZuyxF-sask6jSaORbifpIZVW-PDtiu5mwXzaF5qh2O34Ispj0MoZH2b-B5YNHdW2k6ie-v8Ykde4X1hLdq8rT9zbN5WmG_Zb29jJVSu6N414c5sy5o821HFMPQkDLy_orlT_=s0-d-e1-ft#https:\/\/img.faselis.com\/faselis_tr\/brands\/12586\/inline\/1784699395_260722_Kaspersky_bb_g__rsel_1.jpg.jpg\")
<\/p>\nKaspersky, sald\u0131rganlar\u0131n Microsoft’un kimlik do\u011frulama mekanizmas\u0131n\u0131 k\u00f6t\u00fcye kulland\u0131\u011f\u0131 bir oltalama (phishing) kampanyas\u0131na ili\u015fkin yeni bir\u00a0rapor\u00a0yay\u0131mlad\u0131. 2026\u2019n\u0131n Nisan ba\u015f\u0131ndan May\u0131s ortas\u0131na kadar devam eden ve bir hukuk firmas\u0131ndan gelmi\u015f gibi kurgulanan kampanyan\u0131n temel amac\u0131, ma\u011fdurlar\u0131n kimlik bilgilerini ele ge\u00e7irerek verilerine eri\u015fim sa\u011flamakt\u0131. Kaspersky daha \u00f6nce de\u00a0Google Tasks,\u00a0Google Forms,\u00a0Bubble\u00a0ve\u00a0Amazon Simple Email Servicegibi platformlar\u0131 istismar eden oltalama sald\u0131r\u0131lar\u0131na kar\u015f\u0131 uyar\u0131larda bulunmu\u015ftu.<\/p>\n
Microsoft’un OAuth 2.0 Device Authorization Grant (Cihaz Yetkilendirme Ak\u0131\u015f\u0131) olarak bilinen kimlik do\u011frulama mekanizmas\u0131, ak\u0131ll\u0131 televizyonlar gibi giri\u015f yapman\u0131n zor oldu\u011fu cihazlarda kullan\u0131c\u0131lar\u0131n Microsoft hesaplar\u0131na oturum a\u00e7abilmesini sa\u011fl\u0131yor. Kullan\u0131c\u0131lar, ba\u015fka bir cihazdan (\u00f6rne\u011fin ak\u0131ll\u0131 telefon veya bilgisayar) bir do\u011frulama kodunu girerek ya da QR kodunu tarayarak oturum a\u00e7abiliyor. Ancak bu kullan\u0131m kolayl\u0131\u011f\u0131, sald\u0131rganlar\u0131n s\u00fcreci k\u00f6t\u00fcye kullanmas\u0131na, hesaplar\u0131 ele ge\u00e7irmesine ve \u00e7ald\u0131klar\u0131 yenileme (refresh) belirte\u00e7leri (token) sayesinde eri\u015fimlerini s\u00fcrd\u00fcrebilmesine de zemin haz\u0131rl\u0131yor.<\/p>\n
Sald\u0131r\u0131 kapsam\u0131nda ma\u011fdurlara, bir hukuk b\u00fcrosundan g\u00f6nderilmi\u015f izlenimi veren ve ekinde parola korumal\u0131 bir PDF dosyas\u0131 yer alan e-postalar iletildi. Dosyay\u0131 a\u00e7\u0131p parolay\u0131 giren kullan\u0131c\u0131lar, \u00e7e\u015fitli belgelerin listelendi\u011fi bir web sayfas\u0131na y\u00f6nlendirildi. Belgeleri g\u00f6r\u00fcnt\u00fclemek isteyen kullan\u0131c\u0131lar\u0131n i\u00e7in verilen ba\u011flant\u0131ya t\u0131klamak gerekiyordu ve s\u00f6z konusu ba\u011flant\u0131 kullan\u0131c\u0131y\u0131 Microsoft\u2019un resmi adresine y\u00f6nlendiriyordu. Ancak URL parametreleri, kullan\u0131c\u0131 Microsoft sayfas\u0131n\u0131 a\u00e7t\u0131ktan hemen sonra sahte (oltalama) bir kayna\u011fa aktar\u0131lacak \u015fekilde yap\u0131land\u0131r\u0131lm\u0131\u015ft\u0131.<\/p>\n
\u00a0<\/p>\n
\u00a0<\/p>\n
Dok\u00fcmandaki ba\u011flant\u0131, kullan\u0131c\u0131y\u0131 Microsoft’un resmi sayfas\u0131ndan, hukuki belgelerin g\u00f6r\u00fcnt\u00fclendi\u011fi izlenimi veren bir oltalama sayfas\u0131na y\u00f6nlendiriyor.<\/em><\/p>\n Oltalama Sayfas\u0131<\/em><\/p>\n Oltalama sayfas\u0131nda, muhtemelen g\u00fcvenlik tehditlerini denetleyen g\u00fcvenlik tarama botlar\u0131 filtrelemek amac\u0131yla birden fazla CAPTCHA do\u011frulama ad\u0131m\u0131 kullan\u0131ld\u0131.\u00a0Kullan\u0131c\u0131 bu do\u011frulamalar\u0131 tamamlad\u0131ktan sonra, tek kullan\u0131ml\u0131k bir kodu kopyalamas\u0131n\u0131n istendi\u011fi son sayfaya y\u00f6nlendirildi. Bu kod, sald\u0131rganlar\u0131n kendi taraflar\u0131nda oturum a\u00e7ma s\u00fcrecini ba\u015flatarak \u00f6nceden elde etti\u011fi do\u011frulama koduydu.<\/p>\n Kimlik av\u0131 sayfas\u0131ndaki tek kullan\u0131ml\u0131k kod<\/em><\/p>\n G\u00f6r\u00fcnt\u00fclenen tek kullan\u0131ml\u0131k koda t\u0131kland\u0131\u011f\u0131nda kod otomatik olarak panoya kopyalan\u0131rken, kullan\u0131c\u0131 da e\u015f zamanl\u0131 olarak Microsoft’un resmi kimlik do\u011frulama sayfas\u0131na y\u00f6nlendirildi ve buraya kodu yap\u0131\u015ft\u0131rmas\u0131 istendi.<\/p>\n Kullan\u0131c\u0131 kodu girdikten sonra \u00e7ok fakt\u00f6rl\u00fc kimlik do\u011frulama (MFA) s\u00fcreci tamamland\u0131 ve sald\u0131rganlar oturum belirte\u00e7lerinin (session tokens) kontrol\u00fcn\u00fc ele ge\u00e7irdi. Bu sayede sald\u0131rganlar, ma\u011fdurun e-posta kutusundan ileti okuyup g\u00f6nderebilir, OneDrive \u00fczerindeki dosyalar\u0131 d\u0131\u015far\u0131 aktarabilir ve Teams g\u00f6r\u00fc\u015fmelerine eri\u015febilir hale geldi.<\/p>\n Kaspersky Anti-Spam Uzman\u0131 Roman Dedenok<\/strong>\u00a0konuya ili\u015fkin de\u011ferlendirmesinde \u015funlar\u0131 kaydetti:\u00a0\u201cSald\u0131rganlar hassas verilere eri\u015fmek i\u00e7in her zaman kimlik bilgilerini \u00e7almaya veya k\u00f6t\u00fc ama\u00e7l\u0131 yaz\u0131l\u0131m yaymaya bel ba\u011flam\u0131yor; me\u015fru ara\u00e7lar\u0131 da birer silaha d\u00f6n\u00fc\u015ft\u00fcrebiliyorlar. Bu nedenle kullan\u0131c\u0131lar\u0131n yaln\u0131zca \u015f\u00fcpheli siteleri ziyaret ederken de\u011fil, resmi platformlarda gezinirken de son derece dikkatli olmalar\u0131 gerekiyor. Kurumsal g\u00fcvenlik ekiplerinin, Cihaz Kodu Ak\u0131\u015f\u0131 (Device Code Flow) mekanizmas\u0131n\u0131n \u015firket altyap\u0131s\u0131ndaki i\u015f gereksinimini de\u011ferlendirmelerini \u00f6neriyoruz. Bu kimlik do\u011frulama y\u00f6ntemi g\u00fcnl\u00fck operasyonlar i\u00e7in elzem de\u011filse, devre d\u0131\u015f\u0131 b\u0131rak\u0131lmal\u0131d\u0131r.\u201d<\/em><\/p>\n Cihaz Kodu Oltalama (Device Code Phishing) sald\u0131r\u0131lar\u0131na kar\u015f\u0131 kapsaml\u0131 bir savunma mekanizmas\u0131 olu\u015fturmak i\u00e7in kurumlar\u0131n g\u00fc\u00e7l\u00fc e-posta g\u00fcvenli\u011fi \u00e7\u00f6z\u00fcmleri da\u011f\u0131tmas\u0131 kritik \u00f6nem ta\u015f\u0131yor. Kurumsal kullan\u0131c\u0131lar taraf\u0131nda, yapay zek\u00e2 ve makine \u00f6\u011frenimi algoritmalar\u0131yla desteklenen \u00e7ok katmanl\u0131 koruma sunan\u00a0Kaspersky Security for Mail Server, geli\u015fen tehditlere kar\u015f\u0131 g\u00fc\u00e7l\u00fc bir kalkan olu\u015fturarak i\u015fletmelere g\u00fcvenli bir \u00e7al\u0131\u015fma ortam\u0131 sunuyor. Bireysel kullan\u0131c\u0131lar i\u00e7in ise\u00a0Kaspersky Premium, yapay zek\u00e2 destekli kimlik av\u0131 \u00f6nleme \u00f6zellikleriyle oltalama sald\u0131r\u0131lar\u0131ndan korunmaya ve genel siber g\u00fcvenli\u011fi art\u0131rmaya yard\u0131mc\u0131 oluyor.<\/p>\n \u00a0<\/p>\n \u00a0<\/p>\n \u00a0<\/p>\n Kaynak: (BYZHA) Beyaz Haber Ajans\u0131<\/p>\n","protected":false},"excerpt":{"rendered":" Kaspersky, sald\u0131rganlar\u0131n Microsoft’un kimlik do\u011frulama mekanizmas\u0131n\u0131 k\u00f6t\u00fcye kulland\u0131\u011f\u0131 bir oltalama (phishing) kampanyas\u0131na ili\u015fkin yeni bir\u00a0rapor\u00a0yay\u0131mlad\u0131.<\/p>\n","protected":false},"author":1,"featured_media":23977,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[26],"tags":[],"class_list":["post-23976","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-teknoloji"],"_links":{"self":[{"href":"https:\/\/akdenizolay.com.tr\/index.php\/wp-json\/wp\/v2\/posts\/23976","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/akdenizolay.com.tr\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/akdenizolay.com.tr\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/akdenizolay.com.tr\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/akdenizolay.com.tr\/index.php\/wp-json\/wp\/v2\/comments?post=23976"}],"version-history":[{"count":1,"href":"https:\/\/akdenizolay.com.tr\/index.php\/wp-json\/wp\/v2\/posts\/23976\/revisions"}],"predecessor-version":[{"id":23978,"href":"https:\/\/akdenizolay.com.tr\/index.php\/wp-json\/wp\/v2\/posts\/23976\/revisions\/23978"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/akdenizolay.com.tr\/index.php\/wp-json\/wp\/v2\/media\/23977"}],"wp:attachment":[{"href":"https:\/\/akdenizolay.com.tr\/index.php\/wp-json\/wp\/v2\/media?parent=23976"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/akdenizolay.com.tr\/index.php\/wp-json\/wp\/v2\/categories?post=23976"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/akdenizolay.com.tr\/index.php\/wp-json\/wp\/v2\/tags?post=23976"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}![](\"https:\/\/ci3.googleusercontent.com\/meips\/ADKq_NZKNfXKtBtvvvWyp4OXhnvZk9g4sJMV585un115IQ4Uv1fn5KSyGgx0s954jY-FAerBTvwiKS9Xaos1suiAsujV4CxYFcMMmXc_ZnLBGk2Ykz5igaqzCTdee9bDKtECeqkicfxFTQrGo4pq2AX6k0ZHbR9cwudUuixdv2B4=s0-d-e1-ft#https:\/\/img.faselis.com\/faselis_tr\/brands\/12586\/inline\/1784699493_260722_Kaspersky_bb_g__rsel_3.jpg.jpg\")
<\/p>\n![](\"https:\/\/ci3.googleusercontent.com\/meips\/ADKq_NaeDUR79FRq1Q03u3F0Ye7Lyizp79DcIo5Bt8LE8Uy0wXfqHuRGQ1Bokgr7KM4WMQny2RsXuO2-FombcxAMhkWurFw1JDVgoZ6dnrX6Y8fEeHn_Rsq967lMneAM81YvR88chva4cRI3WPjT4D_OW7OBpnYjuz5_QFiJj0qKJQ=s0-d-e1-ft#https:\/\/img.faselis.com\/faselis_tr\/brands\/12586\/inline\/1784699506_260722_Kaspersky_bb_g__rsel_2_.jpg.jpg\")
<\/p>\n