Inside Wazza: Device Code Phishing Kit Targets Microsoft 365 Accounts

Oct 20, 2026 · Original article ↗

Summary

LevelBlue SpiderLabs traced Wazza phishing campaigns active since at least July 2026. The kit uses PDF lures, layered redirects, browser checks and Microsoft device code authentication to seek access to Microsoft 365 accounts.

Key points

Researchers observed multiple campaign waves, active since at least early July 2026 and ongoing at the time of writing, using compromised email accounts to deliver business-themed PDF lures.
Embedded PDF links lead directly to phishing infrastructure or through Google Sites wrappers, with Cloudflare Workers hosting the final device code phishing pages.
The staging framework generates routing tokens and carries campaign parameters between stages. Earlier variants used rotating corporate decoys and subdomain gating; later waves removed those features.
Client-side scripts check for automation, headless browsers and debugging artifacts, encrypt browser-environment data, and attach a browser challenge to protected requests.
Adobe, DocuSign and OneDrive-themed pages present Microsoft OAuth device codes as document verification codes, directing victims through Microsoft authentication rather than collecting passwords in a fake login form.
The backend initializes sessions, supplies verification codes and authentication URLs, and monitors completion or expiration. Encoded campaign data personalizes victim-facing document details.
Researchers recommend disabling device code authentication where unnecessary, restricting its use through Conditional Access, inspecting PDF links, and correlating email, web and identity telemetry.

Article Details

Attack Vectors: Phishing emails sent from compromised accounts deliver business-themed PDF attachments containing malicious hyperlinks.
PDF links lead either through Google Sites pages embedding attacker-controlled content or directly to phishing infrastructure, sometimes through trusted redirectors.
Multi-stage routing uses victim-specific tokens, campaign parameters, decoy websites, browser checks, and Cloudflare Workers-hosted landing pages.
Document-sharing impersonation persuades victims to enter an attacker-supplied Microsoft OAuth device code into a legitimate authentication flow, with the goal of obtaining account access.
Defensive Notes: Disable device code authentication in Microsoft Entra ID where unnecessary; otherwise restrict it through Conditional Access policies.
Correlate email attachment access, suspicious document-sharing visits, and subsequent device code authentication activity.
Inspect externally supplied PDFs for embedded hyperlinks, trusted-service branding, and multi-domain redirect chains.
Monitor Wazza parameters tok, tgm, m, tg, thm, and ch, particularly alongside /r?key= and /meline redirects.
Monitor requests to /api/wazza-config, /api/mint-token, /api/fire-mint, /api/klam-kadity, /api/queltz-narvik, /bb-landing, and /api.php?svc=.
Investigate suspicious .EU domains, randomized Workers subdomains, and decoy redirects using /onlsbdmn, /onfqdn, /eprfx, or /prfxmsmach. The article reports that routing checks and decoy content were removed in later variants.
Train users that entering an unexpected device code can authorize an external application to access their account.

Indicators of compromise

Type	Indicator	Context
DOMAIN	`beton-beton[.]eu`	Domain identified in the IOC table as Wazza phishing infrastructure.
DOMAIN	`bike-msca[.]eu`	Domain identified in the IOC table as Wazza phishing infrastructure.
DOMAIN	`bodi-project[.]eu`	Domain identified in the IOC table as Wazza phishing infrastructure.
DOMAIN	`bruoth-family[.]eu`	Domain identified in the IOC table as Wazza phishing infrastructure.
DOMAIN	`cardamomo[.]eu`	Domain identified in the IOC table as Wazza phishing infrastructure.
DOMAIN	`coppietersrecherche[.]eu`	Domain identified in the IOC table as Wazza phishing infrastructure.
DOMAIN	`diabetesnet[.]eu`	Domain identified in the IOC table as Wazza phishing infrastructure.
DOMAIN	`dymowski[.]eu`	Domain identified in the IOC table as Wazza phishing infrastructure.
DOMAIN	`electroloys[.]com`	Domain identified in the IOC table as Wazza phishing infrastructure.
DOMAIN	`euniverza[.]eu`	Domain identified in the IOC table as Wazza phishing infrastructure.
DOMAIN	`hacsg[.]com`	Domain identified in the IOC table as Wazza phishing infrastructure.
DOMAIN	`hutspotmaken[.]eu`	Wazza domain used for staging, routing, browser protection, and redirects toward the final phishing page.
DOMAIN	`illuminatedminds[.]eu`	Domain identified in the IOC table as Wazza phishing infrastructure.
DOMAIN	`jetcapital[.]eu`	Domain identified in the IOC table as Wazza phishing infrastructure.
DOMAIN	`languagesforwork[.]eu`	Domain identified in the IOC table as Wazza phishing infrastructure.
HOSTNAME	`beacon-surge-sync[.]beacon-surge-sync[.]workers[.]dev`	First-wave beacon endpoint queried by the preloader to obtain a value carried into subsequent Wazza requests.
HOSTNAME	`beaconoflinenew[.]lastfightlink[.]workers[.]dev`	Second-wave beacon endpoint queried during Wazza's validation preloader.
HOSTNAME	`c5id-pc17-fffoub1-bul3-ahv1-r00kubt[.]ondrv-pwrbi3-s3ntln-quesvxs-l0gsvx-entr-m365s-cmplncx-ehubn[.]workers[.]dev`	Workers-hosted final phishing landing page listed in the article's IOCs.
HOSTNAME	`d3m9a-goo2ns-wx0g-jzhuc2-t9r2b9i[.]dvps-azbl-fnapp-trc3svc-synpx-quesvxs-purv3-siemsvx-cmplncx[.]workers[.]dev`	Workers-hosted final phishing landing page listed in the article's IOCs.
HOSTNAME	`dv0psh-purv3w-azfn-b2c0-msauth3-m365svc-s3ntln-4zrfn3x-cntnrx[.]workers[.]dev`	Workers-hosted final phishing landing page listed in the article's IOCs.
HOSTNAME	`purv3w3-t3ms4pp-certs-intun3-sbussvx-4zredg-siemsv-pip3ln-0ffc3[.]workers[.]dev`	Workers-hosted final phishing landing page listed in the article's IOCs.
HOSTNAME	`ssosvc-m365s-kvl-dv0pshb-s3ntln-c0mply-4zrmonx-apimgwx-evnthb[.]workers[.]dev`	Workers-hosted final phishing landing page listed in the article's IOCs.
HOSTNAME	`unhf69e-e0ppo-l0qoo-a12bcfj-ig1sa4v[.]wndws-pip3ln-sql3-waf3-purv3-gdprsx-dfn-azfn-appsvc-0ffapx[.]workers[.]dev`	Final device code phishing host reached after Wazza's /meline redirect.
HOSTNAME	`wndws-pip3ln-sql3-waf3-purv3-gdprsx-dfn-azfn-appsvc-0ffapx[.]workers[.]dev`	Workers-hosted final phishing infrastructure identified in the IOC table.
URL	`hxxps[:]//fgwhjmdaurspxvznk[.]hutspotmaken[.]eu/B4fWRuA`	Attacker-controlled resource embedded by the Google Sites wrapper; serves Wazza's staging and routing script.
URL	`hxxps[:]//sites[.]google[.]com/view/kjvcfdswqazxcfvghjoplkjmnbvcf/home`	Specific Google Sites staging page embedding attacker-controlled Wazza phishing content.