Full Report
Two Microsoft 365 attacks got through Conditional Access policies that seemed fully configured. Learn what went wrong and how Huntress Managed ISPM catches these gaps first.
Analysis Summary
# Incident Report: Bypassing Microsoft 365 Conditional Access via OAuth Exploitation
## Executive Summary
During 2026, two distinct large-scale campaigns exploited specific Microsoft 365 authentication flows to bypass MFA and Conditional Access (CA) policies. The "Railway" campaign utilized Device Code Phishing to harvest tokens, while the "LSHIY" campaign used Resource Owner Password Credentials (ROPC) to spray credentials directly against the token endpoint. Both incidents highlight critical gaps in default CA configurations that allow attackers to sidestep MFA using deprecated or input-constrained auth flows.
## Incident Details
- **Discovery Date:** March 2026 (Railway); June 2026 (LSHIY)
- **Incident Date:** Continuous throughout 2026
- **Affected Organization:** 344 organizations (Railway); 64 organizations (LSHIY)
- **Sector:** Diversified (notably Construction)
- **Geography:** US, Canada, Australia, New Zealand, Germany
## Timeline of Events
### Initial Access
- **Date/Time:** March 2026 (Initial spike)
- **Vector:** Device Code Phishing (Railway) and ROPC Password Spraying (LSHIY).
- **Details:** Attackers leveraged the legitimate `Railway.com` PaaS infrastructure to host phishing engines, ensuring a "clean" IP reputation to evade Microsoft’s risk-based detection.
### Lateral Movement
- **Technique:** OAuth Token Replay/Theft. Once a token was generated via the device code flow or ROPC, attackers maintained access to the user's environment without requiring further MFA prompts for up to 90 days.
### Data Exfiltration/Impact
- **Details:** Access to Microsoft 365 suites, including Outlook and SharePoint. The LSHIY campaign specifically targeted the Azure CLI to automate access.
### Detection & Response
- **Discovery:** Huntress SOC identified anomalous login surges from specific PaaS IP ranges (`Railway.com`) and a massive volume (81 million attempts) from LSHIY LLC’s IPv6 range.
- **Response Actions:** Identification of the "EvilTokens" Phishing-as-a-Service platform; implementation of managed ISPM (Identity Security Posture Management) to block specific auth flows.
## Attack Methodology
- **Initial Access:** Device Code Phishing lures (Social Engineering) and ROPC Password Spraying.
- **Persistence:** Long-lived OAuth tokens (up to 90 days).
- **Privilege Escalation:** Exploitation of default user permissions to access sensitive cloud resources.
- **Defense Evasion:** Use of trusted PaaS IP addresses (`Railway.com`) and triple-wrapped URLs (Cisco, Trend Micro, SafeLinks) to bypass email filters.
- **Credential Access:** Token harvesting (Railway); Validated credential replay (LSHIY).
- **Lateral Movement:** Utilizing valid OAuth tokens to access different M365 services.
- **Impact:** Full account takeover and potential for data exfiltration via Azure CLI.
## Impact Assessment
- **Financial:** High potential (costs associated with remediation for 400+ organizations).
- **Data Breach:** Compromised accounts across hundreds of organizations; volume of data stolen unspecified but potentially high.
- **Operational:** Significant disruption due to account lockouts and mandatory remediation.
- **Reputational:** Damage to organizations whose trusted domains were used to spread phishing lures.
## Indicators of Compromise
- **Network Indicators:**
- IP traffic originating from `Railway.com` infrastructure.
- IPv6 ranges associated with `LSHIY LLC`.
- **Behavioral Indicators:**
- Logins via `Azure CLI` from unexpected locations.
- Success/Failure events at the `https://login.microsoftonline[.]com/common/oauth2/deviceauth` endpoint.
- Usage of ROPC flow (Resource Owner Password Credentials) in environments where it is not business-justified.
## Response Actions
- **Containment:** Revoking all active refresh tokens for affected users.
- **Eradication:** Blocking the "Device Code Flow" and "ROPC" flow within Microsoft Entra ID Conditional Access policies.
- **Recovery:** Resetting passwords for accounts targeted in the LSHIY spray and updating CA policies to include "All Apps" rather than just specific office apps.
## Lessons Learned
- **MFA is not a Silver Bullet:** Attackers can sidestep MFA by using auth flows that don't trigger it (ROPC) or by tricking users into completing it for the attacker (Device Code Flow).
- **Implicit vs. Explicit Policy:** Many CA policies are configured to "Allow" known apps but fail to "Block" legacy/alternative flows explicitly.
- **Infrastructure Trust:** Attackers are increasingly using legitimate PaaS providers to bypass IP reputation-based security.
## Recommendations
- **Disable Legacy Auth:** Explicitly disable ROPC and other legacy authentication protocols.
- **Restrict Device Code Flow:** Block the device code flow unless there is a specific, documented business need for input-constrained devices.
- **Harden Conditional Access:** Ensure policies are applied to "All Cloud Apps" and not just specific applications like Office 365 or Teams.
- **Implement ISPM:** Use Identity Security Posture Management to continuously monitor for new or unblocked authentication pathways.