CIS Details Device Code Phishing’s Growth and Impact on U.S. SLTTs
Summary
CIS CTI reports device code phishing activity rising against U.S. SLTTs as PhaaS kits automate OAuth 2.0 account takeovers. It describes token persistence and post-compromise abuse, and advises revoking tokens and removing rogue device registrations.
Key points
- CIS CTI assesses that device code phishing will likely continue to evolve and affect U.S. state, local, tribal, and territorial organizations.
- Lures direct users to enter a device code in a legitimate identity-provider portal, authorizing a malicious device through OAuth 2.0 without password harvesting or intentionally triggering MFA prompts.
- Threat actors can obtain access and refresh tokens and establish further sessions; the article says this access may survive password resets, MFA changes, and session logouts. Administrators should revoke tokens and remove rogue device registrations.
- Reported post-compromise activity includes registering additional devices, changing email rules to hide messages, enumerating contacts, and using Microsoft Graph API access to collect data from cloud services.
- The article describes PhaaS kits including EvilTokens and Kali365 automating device-code generation and token renewal, while offering campaign dashboards and tailored lures.
- In one reported U.S. SLTT incident, a compromised account was used to send phishing emails to personnel at nearly 400 external organizations.
Article Details
- Attack Vectors
- Victims receive tailored phishing emails with links or PDF attachments that lead to attacker-controlled pages.
- The page displays a device code requested through a legitimate identity-provider API. Victims are instructed to enter it in the genuine identity-provider portal, unknowingly approving the attacker’s OAuth 2.0 device authorization request.
- After obtaining access tokens, attackers access victim accounts and cloud services, register additional devices, alter email handling rules, search tenant directories and address books, and access or exfiltrate data.
- Compromised accounts are used to send further tailored phishing emails and attempt business email compromise for financial fraud.
- Defensive Notes
- After a suspected compromise, explicitly revoke tokens and identify and remove rogue device registrations; password resets, MFA changes, and session logouts alone may not eliminate the foothold.
- The article reports that many organizations lack effective device-code-phishing detection or prevention and specific user training.
MITRE ATT&CK
T1078.004 · Cloud AccountsAttackers use compromised user accounts to access tenant resources and conduct follow-on activity.T1087.004 · Cloud AccountAttackers access tenant directories and user address books to identify targets for follow-on attacks.T1098.005 · Device RegistrationAttackers register additional malicious devices to compromised user accounts to maintain access.T1114 · Email CollectionAttackers use Graph API access to access sensitive email and conversation data in compromised tenants.T1528 · Steal Application Access TokenAttackers retrieve access tokens generated for the malicious device after victims approve the device authorization request.T1530 · Data from Cloud StorageAttackers exfiltrate documents from shared drives and applications including SharePoint and OneDrive.T1550.001 · Application Access TokenAttackers use OAuth access tokens to authenticate as compromised users through APIs.T1564.008 · Email Hiding RulesAttackers alter email handling rules to archive and mark messages as read, then delete warnings and sent phishing lures.T1566.001 · Spearphishing AttachmentSome phishing emails deliver the lure link in a PDF attachment.T1566.002 · Spearphishing LinkPhishing emails contain links to attacker-controlled device-code phishing pages.T1657 · Financial TheftAttackers use compromised accounts and exfiltrated information in attempted business email compromise attacks for financial fraud.
Vendors
CloudflareThreat actors also often host page lure infrastructure on trusted domains (e.g., Cloudflare workers, etc.) or use such services to route users through redirection loops.Microsoftis largely due to the tactic’s integration into Phishing as a Service (PhaaS) kits, which according to Microsoft has enabled threat actors to further integrate and scale this technique across their attack chains for
Products
Cloudflare WorkersThreat actors also often host page lure infrastructure on trusted domains (e.g., Cloudflare workers, etc.) or use such services to route users through redirection loops.Exchange Onlinedocuments from SharePoint and OneDrive, conversation history from Teams, and sensitive emails from Exchange Online.Microsoft OneDriveinformation directly from shared drives and applications, such as documents from SharePoint and OneDrive, conversation history from Teams, and sensitive emails from Exchange Online.Microsoft SharePointexfiltrate sensitive information directly from shared drives and applications, such as documents from SharePoint and OneDrive, conversation history from Teams, and sensitive emails from Exchange Online.Teamsshared drives and applications, such as documents from SharePoint and OneDrive, conversation history from Teams, and sensitive emails from Exchange Online.
Tools
EvilTokensAcross these incidents, threat actors leveraged two PhaaS kits: Kali365 and the recently disrupted EvilTokens, per another report from Microsoft.Kali365Across these incidents, threat actors leveraged two PhaaS kits: Kali365 and the recently disrupted EvilTokens, per another report from Microsoft.