Microsoft Details Storm-2372’s AI-Enabled OAuth Device-Code Phishing Campaign

Apr 7, 2026 · Original article ↗

Summary

Microsoft describes Storm-2372’s device-code phishing campaign, detailing how dynamic code generation enabled token theft and how attackers used compromised accounts for reconnaissance, persistence and email exfiltration.

Key points

Microsoft reports that Storm-2372 generated OAuth device codes when victims clicked phishing links, avoiding the expiration problem of codes sent in advance.
Role-targeted lures, reportedly created with generative AI, led victims through redirect chains to attacker-controlled pages.
Scripts copied device codes to victims’ clipboards and polled attacker infrastructure; when victims completed sign-in, attackers obtained access tokens without stealing passwords.
After gaining access, attackers used Microsoft Graph for reconnaissance and, in some cases, registered devices or created inbox rules to maintain access and collect or conceal email.
Microsoft recommends restricting device-code authentication where possible, using Conditional Access and sign-in risk policies, and revoking refresh tokens if compromise is suspected.
Defenders can monitor for suspicious device-code sign-ins, including error code 50199 followed by successful authentication, and investigate related device-registration and inbox-rule activity.

Article Details

Attack Vectors: Role-targeted phishing emails used invoice, RFP, document-access, and voicemail lures with links or PDF and HTML attachments.
Redirect chains through compromised legitimate domains and serverless platforms led victims to attacker-controlled device-code phishing pages.
Page scripts generated live OAuth device codes on demand, copied them to victims’ clipboards, and directed users to complete authentication at the legitimate Microsoft device-login portal.
Polling of the attacker backend detected successful authentication and provided access to live tokens; the actors then used Microsoft Graph for reconnaissance and created inbox rules or registered devices for persistence and email collection.
Defensive Notes: Block device-code flow where possible; where it is needed, control it through Conditional Access policies.
Use anti-phishing policies and Safe Links, and educate users to scrutinize unexpected sign-in requests and suspicious links.
Monitor for anomalous device-code sign-ins, suspicious IP ranges, and error code 50199 followed by a successful sign-in.
If compromise is suspected, revoke refresh tokens and consider requiring re-authentication through Conditional Access.
Use sign-in risk policies and reports, monitor device registrations and inbox-rule creation, and apply least privilege to privileged accounts.

Indicators of compromise

Type	Indicator	Context
DOMAIN	`graph-microsoft[.]com`	Attacker-used impersonation domain described as part of the phishing infrastructure.
DOMAIN	`office365-login[.]com`	Attacker-used impersonation domain used in phishing redirects or landing pages.
DOMAIN	`portal-azure[.]com`	Attacker-used impersonation domain described as part of the phishing infrastructure.
HOSTNAME	`a7b2-c9d4[.]office-verify[.]net`	Randomized attacker-used subdomain observed in the phishing infrastructure.
IPV4	`160[.]220[.]232[.]0`	Part of a Railway.com threat-actor infrastructure range observed in sign-ins.
IPV4	`160[.]220[.]234[.]0`	Part of a Railway.com threat-actor infrastructure range observed in sign-ins.
IPV4	`185[.]81[.]113[.]0`	Part of an HZ Hosting threat-actor infrastructure range observed in sign-ins.
IPV4	`8[.]228[.]105[.]0`	Listed in the article’s detection query as part of a suspicious IP range for device-code authentication.
IPV4	`89[.]150[.]45[.]0`	Part of an HZ Hosting threat-actor infrastructure range observed in sign-ins.