LevelBlue Finds 70+ Instances of Device-Code Phishing Kit, Assesses Code as AI-Assisted
Summary
LevelBlue researchers linked more than 70 phishing-kit instances through shared infrastructure and code. The kits exploit Microsoft device-code sign-in to capture account tokens; researchers assess the codebase was largely AI-assisted.
Key points
- Researchers identified more than 70 instances sharing a backend and admin panel, with panel names including BlackApex, DarkApex, SPY and XXX101.
- The kit uses tailored business-themed lures and trusted cloud services to direct targets into Microsoft device-code sign-in.
- Victims enter a code on Microsoft's genuine sign-in page; the backend polls for completion and captures access and refresh tokens, as well as Primary Refresh Tokens.
- Researchers assess with high confidence that the codebase was largely AI-assisted, citing consistent patterns across lures, verbose comments and polished error handling.
- A robots.txt file exposed portal paths, and researchers found multiple API paths reportedly accessible without authentication.
- Recommended defenses include monitoring Microsoft Entra ID for unusual deviceCodeFlow sign-ins and blocking or restricting device-code authentication with Conditional Access.
Article Details
- Attack Vectors
- Spearphishing emails delivered a device-code lure through either a highlighted shared-document link or a PDF attachment linking to a Microsoft Forms page.
- The lure asked victims to enter an attacker-generated device code on Microsoft's genuine device sign-in page and complete the authentication themselves.
- The phishing kit used a multi-stage redirection pipeline, including a Turnstile check and configurable static or victim-specific landing URLs.
- Defensive Notes
- Review Microsoft Entra ID sign-in logs for unusual deviceCodeFlow events, especially from unmanaged devices, unexpected IP ranges, or unfamiliar user agents.
- Where practical, block device-code authentication with Conditional Access; otherwise restrict it to compliant devices, named locations, or approved administrator groups.
- Train users to treat unexpected requests to enter an access or device code as suspicious, even when the sign-in page is genuine Microsoft, and to report suspicious messages promptly.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | 1mdrvpdf-rfqonlineinvite[.]com | Phishing landing-page domain listed among infrastructure associated with the kit. |
| DOMAIN | aaqkadnmmwuxntg2l[.]apiaccoumtsvcdocushare[.]icu | Phishing landing-page domain listed among infrastructure associated with the kit. |
| DOMAIN | arcomplianceservices[.]cfd | Phishing landing-page domain listed among infrastructure associated with the kit. |
| DOMAIN | aviationcustom[.]top | Phishing landing-page domain listed among infrastructure associated with the kit. |
| DOMAIN | bloob-seattacfiile[.]info | Phishing landing-page domain listed among infrastructure associated with the kit. |
| DOMAIN | clouddecktech[.]online | Phishing landing-page domain listed among infrastructure associated with the kit. |
| DOMAIN | debittordis[.]top | Phishing landing-page domain listed among infrastructure associated with the kit. |
| DOMAIN | hsuonoormidimostrareguillarianmelengueleandoinfundieseis[.]fit | Phishing landing-page domain listed among infrastructure associated with the kit. |
| DOMAIN | jeoandmass[.]com | Phishing landing-page domain listed among infrastructure associated with the kit. |
| DOMAIN | login[.]enchantingreality[.]com | Phishing landing-page domain listed among infrastructure associated with the kit. |
| DOMAIN | login[.]mantanolo[.]online | Phishing landing-page domain listed among infrastructure associated with the kit. |
| DOMAIN | miscrosoftonlinesecuredemandocument[.]com | Phishing landing-page domain listed among infrastructure associated with the kit. |
| DOMAIN | opttomie[.]com | Phishing landing-page domain listed among infrastructure associated with the kit. |
| DOMAIN | rockleghindustries[.]com | Phishing landing-page domain listed among infrastructure associated with the kit. |
| DOMAIN | securemsexcel[.]online | Phishing landing-page domain listed among infrastructure associated with the kit. |
| IPV4 | 104[.]223[.]79[.]210 | VPS IP listed as hosting the phishing kit's administrative panel. |
| IPV4 | 140[.]150[.]232[.]52 | VPS IP listed as hosting the phishing kit's administrative panel. |
| IPV4 | 146[.]190[.]66[.]199 | VPS IP listed as hosting the phishing kit's administrative panel. |
| IPV4 | 199[.]192[.]20[.]82 | VPS IP listed as hosting the phishing kit's administrative panel. |
| IPV4 | 217[.]217[.]97[.]183 | VPS IP listed as hosting the phishing kit's administrative panel. |
| IPV4 | 37[.]10[.]71[.]147 | VPS IP listed as hosting the phishing kit's administrative panel. |
| IPV4 | 40[.]160[.]141[.]14 | VPS IP listed as hosting the phishing kit's administrative panel. |
| IPV4 | 45[.]13[.]238[.]147 | VPS IP listed as hosting the phishing kit's administrative panel. |
| IPV4 | 47[.]236[.]86[.]160 | VPS IP listed as hosting the phishing kit's administrative panel. |
| IPV4 | 5[.]181[.]156[.]166 | VPS IP listed as hosting the phishing kit's administrative panel. |
| IPV4 | 64[.]224[.]17[.]40 | VPS IP listed as hosting the phishing kit's administrative panel. |
| IPV4 | 87[.]251[.]79[.]252 | VPS IP listed as hosting the phishing kit's administrative panel. |
| IPV4 | 94[.]103[.]188[.]232 | VPS IP listed as hosting the phishing kit's administrative panel. |
| IPV4 | 95[.]133[.]228[.]253 | VPS IP listed as hosting the phishing kit's administrative panel. |
| IPV4 | 95[.]133[.]231[.]24 | VPS IP listed as hosting the phishing kit's administrative panel. |
MITRE ATT&CK
T1204.001 · Malicious LinkVictims were induced to follow links and enter a device code on Microsoft's genuine sign-in page.T1528 · Steal Application Access TokenThe kit's backend redeemed the device code and obtained a live access token and refresh token for the victim's Microsoft 365 account.T1550.001 · Application Access TokenThe article reports that the kit captured a Primary Refresh Token and used it to access victims' mailboxes.T1566.001 · Spearphishing AttachmentOne observed delivery chain used a PDF attachment containing a link that led through a Microsoft Forms page to the device-code lure.T1566.002 · Spearphishing LinkObserved spearphishing emails used highlighted links to lead victims to device-code phishing lures.
Vendors
Products
Adobe Acrobat SignAdobe Acrobat Sign, Microsoft Excel, and OneDrive lures.Microsoft 365 Apps for EnterpriseMicrosoft supports the same mechanism for Microsoft 365 accounts, and attackers have turned it against the people it was designed to help.Microsoft Entra IDIn Microsoft Entra ID, a PRT supports single sign-on across integrated applications, so its compromise can extend beyond a single session and give persistent access to the victim’s identity and resources.Microsoft ExcelAdobe Acrobat Sign, Microsoft Excel, and OneDrive lures.Microsoft FormsThe link opens a shared copy of a Microsoft Forms page on forms.cloud.microsoft, where the attacker has embedded a link.Microsoft OneDriveAdobe Acrobat Sign, Microsoft Excel, and OneDrive lures.Microsoft SharePointThe first sample we analyzed was an HTML page styled like SharePoint.ZoomSharePoint and Zoom lures.