Full Report
Huntress is tracking an evolving wave of device code phishing that abuses trusted Microsoft 365 sign-in flows. Learn the signals defenders should watch for and how to respond.
Analysis Summary
# Tool/Technique: Microsoft 365 Device Code Phishing (EvilTokens/Kali365)
## Overview
This technique exploits the legitimate OAuth 2.0 Device Authorization Grant flow to bypass Multi-Factor Authentication (MFA). Attackers trick users into entering a code on a legitimate Microsoft sign-in page, allowing the attacker to obtain and replay access tokens to gain unauthorized access to Microsoft 365 environments without needing the user's password or deploying malware.
## Technical Details
- **Type**: Technique / Phishing-as-a-Service (PhaaS)
- **Platform**: Microsoft 365 / Entra ID (Azure AD), Google Workspace
- **Capabilities**: MFA bypass, token theft, token replay, persistent access (session hijacking).
- **First Seen**: Notable waves observed in early 2026 (Railway campaign) and April–July 2026 (BL Networks campaign).
## MITRE ATT&CK Mapping
- **TA0001 - Initial Access**
- T1566.002 - Phishing: Spearphishing Link
- **TA0006 - Credential Access**
- T1528 - Steal or Forge Authentication Tokens
- **TA0004 - Privilege Escalation**
- T1548 - Abuse Elevation Control Mechanism
- **TA0003 - Persistence**
- T1098.005 - Account Manipulation: Device Registration
## Functionality
### Core Capabilities
- **Legitimate Flow Abuse**: Leverages the official Microsoft device pairing flow (`microsoft.com/devicelogin`) to appear trustworthy.
- **MFA Bypass**: Because the user completes the MFA challenge on their own device/browser for a legitimate Microsoft service, the attacker receives a valid, MFA-satisfied token.
- **Infrastructure Hopping**: Threat actors shift between different hosting providers (Railway, Tencent Cloud, BL Networks) to avoid IP-based reputation filtering.
### Advanced Features
- **Token Replay**: Once the user authorizes the device code, the PhaaS kit automatically captures the token and uses it to establish a session from attacker-controlled infrastructure.
- **Session Persistence**: Kits like **Kali365** are capable of maintaining access even after MFA changes or password resets by leveraging refresh tokens and continuous access flows.
## Indicators of Compromise
- **File Hashes**: N/A (Technique is primarily browser/cloud-based).
- **Network Indicators (Defanged)**:
- `216.203.20[.]95` (BL Networks)
- `193.149.176[.]151` (BL Networks)
- `193.149.176[.]238` (BL Networks)
- `45.61.136[.]129` (BL Networks)
- `AS399629` (BitLaunch / BLNWX ASN)
- **Behavioral Indicators**:
- Successful logins from unusual ASNs (e.g., Railway, Tencent, BL Networks/BitLaunch).
- Successful sign-ins where the "Authentication Method" is "Device Code Flow."
- Multiple identities within the same tenant signing in from the same suspicious VPS IP within a short timeframe.
## Associated Threat Actors
- **EvilTokens** (Phishing-as-a-Service provider)
- **Kali365 / Octopi365** (Phishing kits)
- **Knight Office** (AiTM Phishing Kit - related tradecraft)
## Detection Methods
- **Behavioral Detection**:
- Monitor Entra ID (Azure AD) Sign-in logs for `Authentication Protocol: Device Code`.
- Alert on successful logins originating from known VPS/hosting provider IP ranges that do not match established user patterns.
- Cross-reference sign-in locations; look for "impossible travel" occurring immediately after a device code authentication.
- **Hunt Queries**: Search for `AppDisplayName: "Microsoft Office"` or `Microsoft PowerShell` associated with the Device Code flow from non-standard ISP subnets.
## Mitigation Strategies
- **Hardening**: Disable the Device Code Flow entirely if not required by the business (via Conditional Access policies).
- **Conditional Access (CA)**: Implement policies that require Compliant or Hybrid Joined devices for M365 access, which blocks tokens stolen by non-compliant attacker VPS.
- **Session Management**: Enable **Continuous Access Evaluation (CAE)** to revoke tokens in real-time when anomalies are detected.
- **Response**: If a compromise is suspected, revoke all active Refresh Tokens and initiate a "Sign out from all sessions" for the affected user.
## Related Tools/Techniques
- **Adversary-in-the-Middle (AiTM)**: Similar goal of token theft but uses a proxy server to intercept traffic.
- **Evilginx2**: A popular tool for AiTM phishing.
- **Password Spraying**: Often used in conjunction to identify valid accounts before launching targeted device code phishing.