Full Report
RL recently discovered active Microsoft 365 device code phishing. Here's a walkthrough of how our researchers found the campaign.
Analysis Summary
# Tool/Technique: Microsoft 365 Device Code Phishing
## Overview
This technique involves the abuse of the legitimate **Microsoft OAuth 2.0 Device Authorization Grant** flow. Instead of using a traditional credential-harvesting site to steal passwords, attackers trick victims into entering a specific code into a legitimate Microsoft authorization page. This grants the attacker’s device a token to access the victim’s Microsoft 365 account, effectively bypassing many traditional security measures.
## Technical Details
- **Type:** Technique / Phishing Kit
- **Platform:** Microsoft 365 / Azure AD (Web-based)
- **Capabilities:** Bypasses password collection by using legitimate OAuth flows; authorizes attacker-controlled devices; potential to bypass Multi-Factor Authentication (MFA) if the victim completes the legitimate prompt.
- **First Seen:** Campaign documented May 2026 (per article metadata)
## MITRE ATT&CK Mapping
- **[TA0001 - Initial Access]**
- **[T1566.002 - Phishing: Spearphishing Link]**
- **[TA0006 - Credential Access]**
- **[T1528 - Steal Application Access Token]**
- **[TA0003 - Persistence]**
- **[T1136.003 - Create Account: Cloud Account]** (via authorized device registration)
## Functionality
### Core Capabilities
- **Legitimate Flow Abuse:** Directs users to official Microsoft URLs (e.g., `aka.ms/devicelogin`) to input a "device code."
- **Token Acquisition:** Once the victim enters the code and confirms, the attacker’s application/device receives an access token for the victim's environment.
- **Obfuscation:** Phishing landing pages utilize Unicode characters (Zero Width Spaces/Joiners) to evade simple string-based security filters.
### Advanced Features
- **Phishing-as-a-Service (PhaaS) Integration:** Often bundled with kits like "ClickFix" to turn users into execution vectors.
- **Dynamic Content:** Landing pages are designed to mimic legitimate corporate or Microsoft notifications to provide context for the device code request.
## Indicators of Compromise
- **File Hashes:**
- `87158731a98f30ff8a6280e5e14f094a402a861d` (SHA1)
- **Network Indicators:**
- `aka.ms/devicelogin` (Legitimate but abused)
- `microsoft.com/devicelogin` (Legitimate but abused)
- `login.microsoftonline[.]com/common/oauth2/deviceauth`
- `login.live[.]com/oauth20_remoteconnect.srf`
- **Behavioral Indicators:**
- Presence of hidden Unicode characters in HTML: `E2 80 8B` (ZWS), `E2 80 8C` (ZWNJ), `E2 81 A0` (WJ).
- HTML content containing base64 encoded character sets and strings like `"dc="` or encrypted strings (`evosts`).
## Associated Threat Actors
- **Malware Utkonos** (Researcher attribution/Author of YARA signatures)
- **ClickFix** (Associated Malware-as-a-Service campaign)
## Detection Methods
- **Signature-based detection:** Use the provided YARA rule (`DeviceCode_Phishing_LandingPageHTML`) to scan for HTML landing pages containing specific Microsoft OAuth endpoints and hidden Unicode obfuscation characters.
- **URL Analysis:** Crawling and capturing HTML response pages to identify the specific `dc=` (device code) parameter combined with device login links.
- **Retro-hunting:** Using Spectra Analyze or similar tools to search historical file corpuses for the specified Unicode and string patterns.
## Mitigation Strategies
- **User Education:** Train users to never enter a code into a "Device Login" page unless they have personally initiated a login on a secondary hardware device (e.g., a Smart TV or IoT device).
- **Conditional Access:** Implement strict Conditional Access policies in Microsoft 365 to restrict device registration and token issuance to compliant or hybrid-joined devices only.
- **Monitoring:** Monitor Azure AD sign-in logs for unusual device names or registrations originating from unexpected locations immediately following a successful login.
## Related Tools/Techniques
- **Adversary-in-the-Middle (AiTM):** Often used in conjunction or as an alternative to steal session cookies.
- **OAuth App Consent Phishing:** A similar technique where users are tricked into granting permissions to a malicious third-party application.