Full Report
During the June Tradecraft Tuesday, Huntress researchers looked at device code phishing variations and why threat actors love this attack so much.
Analysis Summary
# Tool/Technique: Device Code Phishing (OAuth Abuse)
## Overview
Device code phishing is an identity-based attack that abuses the **OAuth 2.0 Device Authorization Grant** flow. Originally designed for devices with limited input capabilities (like Smart TVs or IoT devices), this technique tricks users into authorizing an attacker’s session on their own account. By entering a legitimate code into a legitimate Microsoft portal, the victim grants the attacker a scoped access token, effectively bypassing Multi-Factor Authentication (MFA).
## Technical Details
- **Type**: Technique / Attack Pattern
- **Platform**: Cross-platform (specifically targeting SaaS environments like Microsoft 365, Azure, and Google Cloud)
- **Capabilities**: MFA bypass, session hijacking, token theft, persistent account access.
- **First Seen**: Introduced conceptually in 2020 by Dr. Nestori Syynimaa; surge in active exploitation noted in 2025-2026.
## MITRE ATT&CK Mapping
- **[TA0001 - Initial Access]**
- [T1566.002 - Phishing: Spearphishing Link]
- **[TA0006 - Credential Access]**
- [T1528 - Steal Application Access Token]
- **[TA0004 - Privilege Escalation]**
- [T1550.017 - Use Alternate Authentication Material: Web Session Cookie/Token]
## Functionality
### Core Capabilities
- **Legitimate Infrastructure Abuse**: The attack uses official Microsoft/Google login portals (e.g., `microsoft.com/devicelogin`), making it difficult for users to identify as a scam.
- **MFA Bypass**: Because the user completes the MFA challenge on their own trusted device to "authorize" the code, the resulting token provided to the attacker is already authenticated.
- **Token Generation**: Attackers programmatically request a device code from the identity provider and present it to the victim via phishing lures.
### Advanced Features
- **PhaaS Integration**: Integration into Phishing-as-a-Service platforms for automated token replay and management.
- **Automated Exfiltration**: Real-time backend processing that captures the access and refresh tokens the moment the victim enters the code.
## Indicators of Compromise
- **Network Indicators**:
- `microsoft[.]com/devicelogin` (Legitimate site, but used in malicious context)
- `railway[.]com` (Abused PaaS infrastructure for token replay)
- **Behavioral Indicators**:
- Sign-ins from unusual locations immediately following a successful OAuth device flow.
- Applications like "Azure PowerShell" or "Microsoft Office" requesting access from non-standard IP ranges.
- Unexpected "DeviceCode" authentication methods appearing in Entra ID (Azure AD) sign-in logs.
## Associated Threat Actors
- **Storm-2372**: Known for using Microsoft Teams lures to deliver device code phishing.
- **EvilTokens (PhaaS)**: A kit specifically designed for automating this attack.
- **Kali365**: A PhaaS platform that recently integrated device code phishing capabilities.
- **LSHIY LLC**: Associated with infrastructure used in related token-theft campaigns.
## Detection Methods
- **Log Analysis**: Monitor Microsoft Entra ID / Google Workspace logs for the `DeviceCode` authentication flow, especially for users who do not typically use smart TVs or CLI-based logins.
- **Behavioral Detection**: Detect "impossible travel" or logins from known malicious PaaS/hosting providers (e.g., Railway, DigitalOcean) immediately after a device code grant.
- **Identity Security Posture Management (ISPM)**: Use tools to flag when high-privileged accounts use the device code flow.
## Mitigation Strategies
- **Conditional Access Policies**: Restrict the use of the Device Code Flow to specific trusted locations or block it entirely for users who do not require it.
- **User Training**: Educate users that they should never enter a code into a login screen unless they personally initiated a login on a separate, constrained-input device.
- **Token Lifetimes**: Shorten the lifespan of access tokens to reduce the window of opportunity for attackers.
- **Application Filtering**: Disable the "Device Code" grant type for enterprise applications that do not strictly require it.
## Related Tools/Techniques
- **AADInternals**: A toolkit used by researchers (and attackers) to interact with Azure AD/M365.
- **Adversary-in-the-Middle (AiTM)**: A similar class of attack that steals session cookies, though AiTM usually relies on proxying traffic rather than abusing the device code flow.
- **OAuth Consent Phishing**: Tricking users into granting permissions to a malicious third-party application.