Full Report
The Microsoft 365 phishing campaign persuades victims to complete a real authentication process that authorizes an attacker-controlled device.
Analysis Summary
# Tool/Technique: Device Code Phishing (OAuth 2.0 Abuse)
## Overview
This technique involves the exploitation of Microsoft's legitimate OAuth 2.0 **Device Authorization Grant** flow. Unlike traditional phishing that steals credentials via fake login forms, this method persuades the victim to authorize an attacker-controlled device by entering a provided code into a legitimate Microsoft authentication portal. This allows the attacker to bypass passwords and certain Multi-Factor Authentication (MFA) protections by obtaining a valid access token.
## Technical Details
- **Type:** Technique / Phishing Framework
- **Platform:** Microsoft 365 (SaaS/Cloud)
- **Capabilities:** Authentication bypass, Token theft, Defense evasion via Unicode obfuscation.
- **First Seen:** Active campaign discovered late 2023/early 2024.
## MITRE ATT&CK Mapping
- **TA0001 - Initial Access**
- T1566.002 - Phishing: Spearphishing Link
- **TA0006 - Credential Access**
- T1528 - Steal Application Access Token
- **TA0005 - Defense Evasion**
- T1027 - Obfuscated Files or Information (Unicode character interspersing)
- **TA0007 - Discovery**
- T1087.004 - Account Discovery: Cloud Account
## Functionality
### Core Capabilities
- **Legitimate Flow Abuse:** Uses the `microsoft.com/devicelogin` endpoint, making the final stages of the attack occur on a trusted Microsoft domain.
- **Code Generation:** The phishing kit generates and displays a specific user code that links the victim’s session to the attacker's device.
- **Token Acquisition:** Once the victim enters the code and authenticates, the attacker receives the access and refresh tokens for the victim's account.
### Advanced Features
- **Unicode Obfuscation:** The landing pages use invisible Unicode format characters—such as Zero Width Space (ZWS), Word Joiner (WJ), and Zero Width Non-Joiner (ZWNJ)—to break up strings like "Microsoft" or "Account." This prevents simple keyword-based security scanners from flagging the page.
- **ClickFix Styling:** Utilizes a "ClickFix" visual style, mimicking common software update or document review prompts to build false trust.
- **HTML/Image Embedding:** Uses HTML attachments with `cid:` (Content ID) references to local JPG attachments to evade email gateways that scan for external link hosting.
## Indicators of Compromise
- **File Names:** Typically arrives as an HTML attachment referencing a JPG (e.g., image-based lures for "estimates" or "agreements").
- **Network Indicators:**
- `microsoft[.]com/devicelogin` (Legitimate site abused in flow)
- The article implies various C2/Landing page domains, though specific external domains should be monitored for "ClickFix" style patterns.
- **Behavioral Indicators:**
- Presence of high concentrations of `\u200B`, `\u2060`, and `\u200C` characters in HTML source code.
- Unexpected "Microsoft Authentication Broker" prompts indicating "another device" is being authorized.
## Associated Threat Actors
- **ClickFix Campaigns:** Often associated with Malware-as-a-Service (MaaS) operations.
## Detection Methods
- **Behavioral Detection:** Monitor for internal users accessing the device login endpoint (`/devicelogin`) from unusual locations or at high frequencies.
- **YARA Rules:**
- Target the HTML landing pages by looking for high densities of Unicode format characters (`\u200B`, etc.) combined with keywords like "Microsoft" or "Verification."
- **Email Security:** Scan for HTML attachments that use `cid:` tags to display text-heavy images, which is a common tactic to hide the lure from NLP scanners.
## Mitigation Strategies
- **Conditional Access Policies:** Restrict the use of the Device Code Flow to specific trusted devices or disable it if not required for the business environment.
- **User Training:** Educate users that they should never enter codes into a "Device Login" screen unless they are intentionally setting up a secondary hardware device (like a smart TV or CLI tool).
- **Token Revocation:** If compromise is suspected, revoke all active refresh tokens for the user account via the Microsoft Entra ID (formerly Azure AD) portal.
## Related Tools/Techniques
- **Adversary-in-the-Middle (AiTM):** A related but different technique that proxies the entire login session.
- **ClickFix:** A design framework used by various phishing kits to mimic legitimate system prompts.
- **Illicit Consent Grant:** A similar technique where users are tricked into granting permissions to a malicious OAuth application.