Full Report
A phishing campaign has been reported leveraging the EvilTokens Phishing-as-a-Service platform to target O365 users. The attackers use device code phishing to bypass Multi-Factor Authentication (MFA), and they also utilize Railway to host their malicious infrastructure. The ca...
Analysis Summary
# O365 Device Code Phishing Campaign using EvilTokens and Abusing Railway Platform
## Key Points
- A sophisticated phishing campaign is utilizing the **EvilTokens** Phishing-as-a-Service (PhaaS) platform to compromise Microsoft 365 accounts.
- The campaign leverages **Device Code Flow phishing**, a technique that bypasses Multi-Factor Authentication (MFA) by tricking users into authorizing a malicious session on a legitimate Microsoft domain.
- Attackers are abusing the **Railway** (Platform-as-a-Service) cloud infrastructure to host their malicious backend and handle stolen tokens.
- The primary impact involves the exfiltration of Primary Refresh Tokens (PRT) or access tokens, granting attackers persistent access to the victim's O365 environment.
## Threat Actors
- **Attribution:** Currently categorized as **Unknown**.
- **Motivation:** Likely financial or data theft, focusing on end-user compromise and O365 environment access.
## TTPs
- **Device Code Exploitation:** Victims are directed to enter a specific code at the legitimate `hxxps://microsoft[.]com/devicelogin` URL. This authorizes the attacker's application.
- **MFA Bypass:** Because the victim authenticates through a legitimate Microsoft prompt on their own device, existing MFA requirements are satisfied, providing the attacker with a valid session token.
- **Defense Evasion:** By utilizing legitimate Microsoft infrastructure for the authentication process, the attackers avoid triggering alerts associated with traditional credential harvesting sites.
- **Infrastructure Abusal:** Use of the Railway platform to host phishing infrastructure and automate token processing.
## Affected Systems
- **Platform:** Microsoft Office 365 / Microsoft Entra ID.
- **Targeted Technology:** Authentication flows involving Device Code Login.
- **Scope:** End-users within O365 environments.
## Mitigations
- **Restrict Device Code Flow:** Disable the Device Code Flow in Microsoft Entra ID if it is not business-critical for your environment.
- **Conditional Access Policies:** Implement strict Conditional Access policies to limit where and how Device Code authentication can be performed (e.g., restricting to managed devices).
- **User Training:** Educate users on the risks of entering codes into the Microsoft device login page unless they have personally initiated a login on a secondary device (like a smart TV or CLI tool).
- **Monitoring:** Monitor for unusual login activity and the registration of suspicious applications within the O365 tenant.
## Conclusion
This campaign represents a significant shift from traditional credential harvesting to token-based exploitation. By abusing legitimate Microsoft features like the Device Code Flow and leveraging cloud hosting services like Railway, attackers can effectively bypass MFA and maintain a low profile. Organizations should prioritize auditing their Entra ID authentication flows and restricting Device Code authentication to prevent unauthorized token acquisition.