RL identified an active Microsoft 365 device code phishing campaign that abuses Microsoft’s OAuth 2.0 Device Authorization Grant flow to make victims authorize an attacker-controlled device through a real Microsoft login process. The campaign uses business-themed lures, invisible Unicode characters, four-second beaconing, and Entra ID token artifacts to enable account takeover of corporate Microsoft 365 users. #Microsoft365 #MicrosoftEntraID #Akamai #EvoStsArtifacts
Keypoints
- The campaign uses device code phishing instead of a fake login page, relying on a real Microsoft authentication flow.
- The initial lure is a vendor-style email with a clickable image embedded through an HTML attachment and Content ID reference.
- Victims are told to click “Review Document,” copy a verification code, and complete Microsoft sign-in, which authorizes the attacker’s device.
- The phishing page uses ClickFix-style design and invisible Unicode characters to hide suspicious terms from detection.
- The kit opens the legitimate device login URL at aka.ms/devicelogin and targets Microsoft 365 corporate users.
- The backend sends the device code to the phishing host every four seconds and includes a bit-shifted Entra ID token artifact, EvoStsArtifacts.
- Defenders can hunt for the landing page artifacts, Entra ID sign-in logs, and the characteristic network resolution and beaconing pattern.
MITRE Techniques
- [T1566.001 ] Spearphishing Attachment – The initial lure is delivered through an email with an image attachment referenced by a second HTML attachment (‘The lure is constructed using an image attachment referenced in a second HTML attachment.’)
- [T1056.001 ] Keylogging / Input Capture – The kit captures the victim-entered verification code as part of the authentication abuse flow (‘copy the code to their clipboard’ and enter it into the Microsoft popup).
- [T1199 ] Trusted Relationship – The attack abuses trust in Microsoft’s legitimate authentication infrastructure to make the process appear safe (‘This is a real and legitimate URL used for normal Microsoft authentication flows.’)
- [T1133 ] External Remote Services – The attacker leverages Microsoft 365 authentication services to gain access to victim accounts (‘authorize an attacker-controlled device’ and ‘access to victim accounts’).
- [T1550.001 ] Use Alternate Authentication Material: Application Access Token – The device code is used to complete OAuth-based authentication without stealing passwords directly (‘abuses Microsoft’s legitimate OAuth 2.0 Device Authorization Grant flow’).
- [T1119 ] Automated Collection – The kit continuously posts the device code in a timed loop to coordinate the flow (‘sent to the phishing kit’s host via POST on a four second loop’).
- [T1027 ] Obfuscated Files or Information – Unicode format characters and bit-shifted/base64-encoded artifacts are used to hide detection strings (‘Zero Width Space (ZWS), Word Joiner (WJ), and Zero Width Non-Joiner (ZWNJ)’ and ‘bitshifted ASCII’).
- [T1562.001 ] Impair Defenses: Disable or Modify Tools – The page hides red-flag words with invisible Unicode characters to interfere with detection (‘interspersed in words that are typically red flags used for phishing detection’).
Indicators of Compromise
- [URLs ] phishing and landing infrastructure – hxxps[://]aka[.]ms/devicelogin, hxxps[://]login.microsoftonline.com/common/oauth2/deviceauth
- [URLs ] sample lure and kit hosts – hxxps[://]adhere[.]it[.]com/verify/, hxxps[://]one drive-document[.]adhere[.]it[.]com/sharedproject/
- [URLs ] campaign infrastructure examples – hxxps[://]corpexl[.]nl/projectorder/, hxxps[://]horizonex[.]it[.]com/securedocument/
- [URLs ] additional kit domains and paths – hxxps[://]futureanchor[.]it[.]com/cloud/, hxxps[://]verification[.]futureanchor[.]it[.]com/cardcrosoft/
- [Strings ] landing page and token artifacts – “dc=”, “EvoStsArtifacts”
- [Unicode byte sequences ] anti-detection characters used in HTML – E2808B, E2808C, and E281A0
- [Network hostnames ] Microsoft authentication sequence indicators – aka.ms, login.microsoftonline.com, aadcdn.msftauth.net, login.live.com, browser.events.data.microsoft.com
Read more: https://www.reversinglabs.com/blog/device-code-phishing-campaign