DNS Analysis Maps Infrastructure Behind Microsoft 365 Device-Code Phishing Campaign
Summary
Researchers analyzed 290 indicators linked to a Microsoft 365 device-code phishing campaign, finding coordinated redirector and impersonation domains, 87 malicious IP addresses, and evidence that much of the infrastructure remained active.
Key points
- The campaign abused Microsoft 365’s legitimate OAuth 2.0 Device Authorization Grant flow to gain access to victims’ accounts.
- Researchers analyzed 290 indicators: 51 domains and 239 subdomains.
- DNS and registration patterns linked many domains, including shared nameservers and registrations made seconds apart, suggesting coordinated infrastructure.
- The subdomains included random-host redirectors and domains spoofing company names or brands for phishing and business email compromise lures.
- Researchers identified 35 email-connected domains and 87 IP addresses, which their threat-intelligence queries classified as weaponized in various campaigns.
- Most of the infrastructure was still active behind Cloudflare at the time of the analysis; only one domain had been registry-suspended.
Article Details
- Attack Vectors
- Attackers used Microsoft 365’s legitimate OAuth 2.0 Device Authorization Grant flow, persuading victims to authorize an attacker-controlled device.
- The campaign used rotating redirector hosts, spoofed company-name hosts for vendor or invoice lures, generic lures, and brand impersonation for credential harvesting.
- Defensive Notes
- The article recommends supplementary investigation to corroborate entities identified as malicious, since their status may change or later prove harmless.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | couglesrecycilng[.]mom | Campaign domain IoC described as likely registered with malicious intent; it also appeared in the First Watch Malicious Domains Data Feed. |
| DOMAIN | darnel[.]nl | Campaign subdomain IoC; described as a disposable redirector farm with rotating credential and redirect hosts. |
| DOMAIN | datavaner[.]us | Listed as a campaign domain IoC with historical domain-to-IP resolutions. |
| DOMAIN | firmtix[.]com | Campaign domain IoC that received DNS queries from three client IP addresses. |
| DOMAIN | horizoralabs[.]com | Campaign subdomain IoC with spoofed company-name hosts, possibly intended for vendor or business email compromise impersonation. |
| DOMAIN | nexaragroups[.]com | Look-alike domain in the typosquatting group containing the campaign domain IoC nextaragroup[.]app. |
| DOMAIN | nexaragroups[.]in | Look-alike domain in the typosquatting group containing the campaign domain IoC nextaragroup[.]app. |
| DOMAIN | nextaragroup[.]app | Campaign domain IoC identified in a typosquatting group. |
| DOMAIN | notivora[.]nl | Listed as a campaign domain IoC with historical domain-to-IP resolutions. |
| DOMAIN | sparkaxis[.]org | Listed as a campaign domain IoC with historical domain-to-IP resolutions. |
| DOMAIN | taskvault[.]nl | Campaign subdomain IoC; described as an all-random-host redirector farm. |
| DOMAIN | trenix[.]nl | Campaign domain IoC; its subdomains include random hosts and spoofed European company names used for vendor or business email compromise lures. |
| DOMAIN | ventoraco[.]com | Campaign subdomain IoC with spoofed company-name hosts associated with vendor or business email compromise lures. |