LevelBlue Details Phishing Campaign Abusing Microsoft OAuth Device Code Flow
Summary
LevelBlue details a phishing campaign using a fake Adobe site, Mandrill redirects and Microsoft OAuth Device Code Flow to trick users into authorizing tokens, potentially enabling persistent access. It shares KQL detections and Conditional Access mitigations.
Key points
- LevelBlue investigated a phishing campaign using a fake Adobe-themed site to persuade users to authorize a Microsoft Device Code Flow request.
- Mailchimp’s Mandrill links concealed destination URLs in Base64-encoded parameters; a redirect endpoint at ppsrq[.]org/so/3dPniokM8/c accepted authenticated payloads.
- The phishing page requested a device code, displayed the resulting user code, and polled authorization status through its server; the report says the server’s Microsoft requests were not visible to the user.
- If a victim authorizes the request, the campaign could obtain access and refresh tokens, potentially enabling persistent delegated access to Microsoft Graph resources.
- The report says the redirect domain belongs to a nonprofit and suspects its secret or server was compromised, allowing attackers to create a valid malicious URL.
- LevelBlue recommends blocking Device Code Flow with Conditional Access where it is not needed, and provides KQL queries to hunt for device-code sign-ins and related URLs.
- The report notes that device-code endpoint URL hunting may miss activity when there is no immediate redirect to Microsoft’s login page.
Article Details
- Attack Vectors
- Phishing emails used Mailchimp/Mandrill links with Base64-encoded parameters to conceal the final destination.
- A fake Adobe-themed website displayed a Microsoft device code and prompted users to authorize it through the Device Code Flow.
- The phishing site generated device codes through Microsoft services and polled for authorization status, obtaining tokens after a victim approved the request.
- A redirection endpoint on ppsrq[.]org was used to route users to the phishing site; LevelBlue suspected the endpoint or its signing secret had been compromised.
- Access and refresh tokens obtained through successful authorization could enable delegated access to organizational resources through Microsoft Graph.
- Defensive Notes
- Block Device Code Flow through Conditional Access Policies, or explicitly exclude only users and resources with a documented need for it.
- Continuously audit permitted Device Code Flow usage and revoke access when it is no longer required.
- Monitor sign-in logs for AuthenticationProtocol == "deviceCode" and OriginalTransferMethod == "deviceCodeFlow".
- Hunt for device-login URLs in click and browser events, while treating matches as supporting evidence rather than conclusive detection.
- Revoke established sign-in sessions when an account compromise is confirmed.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| URL | hxxps[:]//adobe[.]safest[.]org/ | Phishing destination on a fake Adobe-themed site used in the device-code authorization campaign. |
MITRE ATT&CK
T1078 · Valid AccountsThe report says obtained access and refresh tokens could be used as valid credentials to access tenant resources.T1204 · User ExecutionVictims were prompted to enter the displayed device code and authorize the request, enabling account compromise.T1528 · Steal Application Access TokenThe device-code phishing flow was used to obtain user access and refresh tokens.T1566 · PhishingThe campaign delivered malicious links in email that led to a fake Adobe-themed phishing site.T1583 · Acquire InfrastructureThe campaign used Mailchimp/Mandrill links and a redirection endpoint on ppsrq[.]org; compromise of the endpoint or its secret was suspected.
Vendors
MailchimpPhishing emails used Mailchimp/Mandrill links with Base64-encoded payloads to hide final malicious destinations and bypass initial mail security controls.MicrosoftLevelBlue’s Global Threat Operations identified a phishing campaign that abuses Microsoft’s OAuth 2.0 Device Authorization Grant (Device Code Flow) using a fake Adobe-themed site and compromised redirection
Products
Azure CLI[Application Client ID ] Client identifier used in device code requests – 04b07795-8ddb-461a-bbee-02f9e1bf7b46 (Microsoft Azure CLI example)Entra IDThe client ID value shall be associated with an application object registered in the Entra ID directory of the respective target.Microsoft GraphSuccessful authorization grants persistent delegated access (including refresh tokens) enabling actions via Microsoft Graph such as managing users/groups, Teams messages, Outlook messages, and SharePoint content.Microsoft Identity PlatformThe Microsoft Identity Platform supports both resource-specific permission scopes and well-defined OpenID Connect scopes.Microsoft OutlookRead, manage, and send messages within Microsoft OutlookMicrosoft SharePointSuccessful authorization grants persistent delegated access (including refresh tokens) enabling actions via Microsoft Graph such as managing users/groups, Teams messages, Outlook messages, and SharePoint content.Microsoft TeamsCreate channels and send channel messages within Microsoft Teams