Huntress Details Phishing Kits Targeting Microsoft 365 Tokens and Defender Responses
Summary
Huntress examines three phishing kits targeting Microsoft 365 tokens, explains device-code phishing, AitM and token replay, and offers detection and containment guidance for defenders.
Key points
- Huntress reviewed EvilTokens, Knight Office and Kali365, which target Microsoft 365 tokens.
- Advanced kits can provide dashboards to track victims, modify phishing pages and relay credentials in real time.
- EvilTokens allegedly used Railway PaaS for token harvesting and replay; a Microsoft Digital Crimes Unit and FBI collaboration led to the arrest of an alleged operator.
- Device-code phishing can capture authorization without requiring the victim to give the attacker a password directly. AitM attacks relay authentication and can capture session information even after MFA.
- Stolen sign-in tokens can be replayed to access cloud resources and victim email accounts.
- Huntress recommends correlating lure, authentication, token, device-registration and mailbox activity across identity, endpoint, browser and network telemetry.
- Response steps include revoking refresh tokens, removing unauthorized devices and Windows Hello credentials, restricting device-code authentication where possible, and continuing to monitor for replay or re-entry.
Article Details
- Defense Focus
- Detect and contain phishing-related identity compromise, token theft and replay, and unauthorized device registration by correlating activity across the attack chain.
- Detection Methods
- Investigate successful sign-ins from unfamiliar cloud infrastructure.
- Hunt for device-code authentication and automated token refresh.
- Review newly registered devices, authentication methods, and mailbox activity.
- Correlate the sequence of lure, authentication, token issuance or theft, device registration, and mailbox activity.
- For suspected token replay, investigate how the token was used, including sign-in addresses and new device registrations.
- Continue hunting after the original phishing domain disappears and monitor for replay or re-entry after containment.
- Data Sources
- Identity-provider telemetry
- Endpoint telemetry
- Browser context
- Network telemetry
- Mailbox activity
- Defensive Actions
- Revoke refresh tokens.
- Remove unauthorized devices and Windows Hello credentials.
- Restrict or block device-code authentication where possible; use Conditional Access Policies where appropriate.
- Investigate mailbox access, forwarding rules, and outbound phishing.
- Continue monitoring for token replay or re-entry after containment.
MITRE ATT&CK
T1078.004 · Cloud AccountsA replayed token can be used to access cloud resources and victim email accounts.T1098.005 · Device RegistrationThe article identifies rogue device registration as a signal associated with investigated incidents.T1528 · Steal Application Access TokenThe kits are described as capturing authorization or sign-in tokens, including through device-code phishing.T1550.001 · Application Access TokenThe article describes replaying a stolen sign-in token to establish an active session.T1557 · Adversary-in-the-MiddleIn the described adversary-in-the-middle attacks, the operator relays the authentication flow or intercepts an exchange to capture session information.T1566 · PhishingThe article describes phishing kits that present fake login pages to obtain authentication material.