Researchers Detail Microsoft 365 Device-Code Phishing Campaign Using OAuth
Summary
ReversingLabs analyzes an active campaign targeting corporate Microsoft 365 users. Business-themed lures trick victims into using OAuth device authorization to approve an attacker-controlled device.
Key points
- The campaign uses Microsoft’s legitimate OAuth 2.0 Device Authorization Grant flow rather than a counterfeit password-entry page.
- A vendor-style email uses an image referenced by an HTML attachment; the linked phishing page tells victims to copy a verification code and enter it in a genuine Microsoft sign-in flow.
- The phishing page uses ClickFix-style design and invisible Unicode characters to obscure terms commonly flagged by phishing detection.
- The kit sends device codes to its host in POST requests every four seconds and includes a bit-shifted Microsoft Entra ID Security Token Service artifact, EvoStsArtifacts.
- Researchers describe network indicators combining Microsoft authentication hostname resolutions with the kit’s four-second beaconing, and provide a YARA rule for landing-page detection.
- The article recommends monitoring unusual device authorization activity and reviewing Microsoft Entra ID sign-in logs.
Article Details
- Attack Vectors
- A business-themed vendor email delivers a clickable lure image through an HTML attachment that references the image using a Content ID.
- The landing page instructs victims to copy a displayed verification code and enter it into a genuine Microsoft device sign-in flow, authorizing an attacker-controlled device.
- The phishing kit sends the device code to its host in a POST request on a four-second loop to coordinate the OAuth flow.
- Invisible Unicode format characters are inserted into words on the landing page to obscure suspicious terms from detection.
- Defensive Notes
- Educate users to recognize unexpected device-code authentication prompts and verify requests to authorize another device.
- Review Microsoft Entra ID sign-in logs for unusual device authorization activity.
- Correlate the reported hostname-resolution sequence and four-second beaconing from the same endpoint; Microsoft authentication traffic alone is not identified as malicious.
- Hunt for the landing-page artifacts described in the report, including the Unicode characters, the “dc=” string, and the EvoStsArtifacts artifact.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| URL | hxxps[:]//accounting[.]wgmilshyvn[.]workers[.]dev/ | Phishing landing URL listed among the campaign indicators. |
| URL | hxxps[:]//adhere[.]it[.]com/verify/ | Phishing landing URL listed among the campaign indicators. |
| URL | hxxps[:]//apexviaco[.]com/code/ | Phishing landing URL listed among the campaign indicators. |
| URL | hxxps[:]//biotechgroup[.]p-oye8mc0f[.]workers[.]dev/ | Phishing landing URL listed among the campaign indicators. |
| URL | hxxps[:]//corpexl[.]nl/projectorder/ | Phishing landing URL listed among the campaign indicators. |
| URL | hxxps[:]//documentations[.]apexarolabs[.]com/transfer/ | Phishing landing URL listed among the campaign indicators. |
| URL | hxxps[:]//docusign-arizonacreativeevents[.]nextvexharbor[.]de/review/ | Phishing landing URL listed among the campaign indicators. |
| URL | hxxps[:]//docxfile-share[.]itkljpqn[.]workers[.]dev/ | Phishing landing URL listed among the campaign indicators. |
| URL | hxxps[:]//futureanchor[.]it[.]com/Docusign/ | Phishing landing URL listed among the campaign indicators. |
| URL | hxxps[:]//growthora[.]app/doc/ | Phishing landing URL listed among the campaign indicators. |
| URL | hxxps[:]//horizonex[.]it[.]com/securedocument/ | Phishing landing URL listed among the campaign indicators. |
| URL | hxxps[:]//hsecontractors-project[.]sign-ins[.]workers[.]dev/ | Phishing landing URL listed among the campaign indicators. |
| URL | hxxps[:]//login[.]growthora[.]app/document/ | Phishing landing URL listed among the campaign indicators. |
| URL | hxxps[:]//meeting[.]corpsfileshare[.]com/quarterly/ | Phishing landing URL listed among the campaign indicators. |
| URL | hxxps[:]//metroraco[.]com/GroupeBergeron/ | Phishing landing URL listed among the campaign indicators. |
| URL | hxxps[:]//microsoft-document[.]adhere[.]it[.]com/Adobe-pdf/ | Phishing landing URL listed among the campaign indicators. |
| URL | hxxps[:]//my-team-share[.]corpsfileshare[.]com/team/ | Phishing landing URL listed among the campaign indicators. |
| URL | hxxps[:]//myshare-file[.]sharedfilescorps[.]com/finance/ | Phishing landing URL listed among the campaign indicators. |
| URL | hxxps[:]//nda2026[.]wgmilshyvn[.]workers[.]dev/ | Phishing landing URL listed among the campaign indicators. |
| URL | hxxps[:]//onedrive-document[.]adhere[.]it[.]com/sharedproject/ | Phishing landing URL listed among the campaign indicators. |
| URL | hxxps[:]//onedrive-microsoft[.]adhere[.]it[.]com/securedocument/ | Phishing landing URL listed among the campaign indicators. |
| URL | hxxps[:]//pay-quickbooks[.]nextvexharbor[.]de/snlpainting/ | Phishing landing URL listed among the campaign indicators. |
| URL | hxxps[:]//ringcentral[.]firmtix[.]com/alert/ | Phishing landing URL listed among the campaign indicators. |
| URL | hxxps[:]//sales[.]p-ct5v25xo[.]workers[.]dev/ | Phishing landing URL listed among the campaign indicators. |
| URL | hxxps[:]//secure[.]firmtix[.]com/docx | Phishing landing URL listed among the campaign indicators. |
| URL | hxxps[:]//secured-doc-tnxv-iki[.]c-qar6y6n0[.]workers[.]dev/ | Phishing landing URL listed among the campaign indicators. |
| URL | hxxps[:]//shared[.]firmtix[.]com/file/ | Phishing landing URL listed among the campaign indicators. |
| URL | hxxps[:]//sparkaxis[.]org/deployment/ | Phishing landing URL listed among the campaign indicators. |
| URL | hxxps[:]//trenix[.]nl/alma-resort/ | Phishing landing URL listed among the campaign indicators. |
| URL | hxxps[:]//verification[.]futureanchor[.]it[.]com/cardcrosoft/ | Phishing landing URL listed among the campaign indicators. |
MITRE ATT&CK
T1027 · Obfuscated Files or InformationThe landing page inserts invisible Unicode format characters into suspicious terms, and the article describes a bit-shifted Entra ID artifact.T1071.001 · Web ProtocolsThe phishing kit sends the device code to its host in repeated POST requests over the reported four-second loop.T1204.001 · Malicious LinkThe victim clicks the linked lure image and then interacts with the landing page to continue the device-code flow.T1550.001 · Application Access TokenThe campaign abuses OAuth device authorization so the victim’s authentication flow authorizes an attacker-controlled device to access the account.T1566.001 · Spearphishing AttachmentThe initial lure is delivered by email as an image attachment referenced from a second HTML attachment.
Vendors
Products
Microsoft 365 Apps for EnterpriseRL identified an active Microsoft 365 device code phishing campaign that abuses Microsoft’s OAuth 2.0 Device Authorization Grant flow to make victims authorize an attacker-controlled device through a real MicrosoftMicrosoft Entra IDIn addition to the device code content, there is also a bit-shifted string artifact from Microsoft Entra ID’s Security Token Service: EvoStsArtifacts.