Full Report
During the June Tradecraft Tuesday, Huntress researchers looked at device code phishing variations and why threat actors love this attack so much.
Analysis Summary
# Tool/Technique: Device Code Phishing
## Overview
Device code phishing is a sophisticated social engineering technique that abuses the legitimate **OAuth 2.0 Device Authorization Grant** flow. Originally designed for "input-constrained" devices (like smart TVs or printers) that lack a browser, the process allows a user to authorize a device by entering a short code on a separate, browser-enabled device. Threat actors hijack this workflow to trick users into authorizing the attacker’s own session, thereby stealing authenticated OAuth tokens and bypassing Multi-Factor Authentication (MFA).
## Technical Details
- **Type:** Technique (Abuse of Authentication Flow) / Phishing-as-a-Service (PhaaS)
- **Platform:** Primarily Microsoft 365 (Azure/Entra ID) and Google Cloud.
- **Capabilities:** MFA bypass, token theft, persistent account access without passwords.
- **First Seen:** Conceptually introduced in 2020 by researcher Dr. Nestori Syynimaa.
## MITRE ATT&CK Mapping
- **[TA0001 - Initial Access]**
- [T1566.002 - Phishing: Spearphishing Link]
- **[TA0006 - Credential Access]**
- [T1528 - Steal Application Access Token]
- **[TA0004 - Privilege Escalation]**
- [T1548.003 - Abuse Authorization Mechanism]
## Functionality
### Core Capabilities
- **Legitimate Infrastructure Abuse:** Attackers generate a legitimate device code from Microsoft/Google and present it to the victim. The victim enters this code at a legitimate URL (e.g., `microsoft.com/devicelogin`).
- **Token Theft:** Once the victim approves the request, the attacker's script or framework automatically receives the **Access Token** and **Refresh Token**.
- **MFA Bypass:** Because the victim completes the MFA prompt during the legitimate login process on their own device, the attacker is granted a fully authenticated session.
### Advanced Features
- **PhaaS Integration:** Kits like **EvilTokens**, **Kali365**, and **Knight Office** automate the generation of codes and the capture of tokens.
- **Token Replay/Infrastructure:** Use of platforms like **Railway.com** as "clean" token replay engines to avoid detection based on suspicious source IP addresses.
- **Targeted Lures:** Integration into Microsoft Teams meeting invites to increase the perceived legitimacy of the request.
## Indicators of Compromise
- **File Names:** Often associated with the **AADInternals** toolkit (used by researchers and attackers alike).
- **Network Indicators (Defanged):**
- `microsoft[.]com/devicelogin` (Legitimate site, but unauthorized use is a behavioral indicator).
- `railway[.]app` (Often abused for token replay infrastructure).
- PhaaS-specific domains associated with **Kali365** or **EvilTokens**.
- **Behavioral Indicators:**
- Sign-in logs showing the **"Device Code"** grant type for unexpected applications.
- Successive logins from geographically distant locations (Impossible Travel) immediately following a device code authorization.
- New applications authorized under a user's profile that the user did not intentionally install.
## Associated Threat Actors
- **Storm-2372:** Known for using Microsoft Teams invites to deliver device code phishing lures.
- **LSHIY LLC:** Associated with infrastructure used in recent password spray and token theft campaigns.
- **PhaaS Operators:** Developers behind **EvilTokens** and **Kali365**.
## Detection Methods
- **Behavioral Detection:** Monitor Microsoft Entra ID (Azure AD) sign-in logs for the `Authentication Protocol: Device Code` property.
- **Anomaly Detection:** Alert on device code logins originating from unexpected IP addresses or countries.
- **Unified Audit Log (UAL):** Review for `Add app role assignment to service principal` or similar events occurring shortly after a device code login.
## Mitigation Strategies
- **Conditional Access Policies:** Disable the device code flow entirely if not required for business operations. Use "Filter for devices" to restrict this flow only to specific, trusted devices.
- **Phishing-Resistant MFA:** Implement FIDO2 security keys, which are less susceptible to token theft compared to SMS or push notifications.
- **User Education:** Train users to never enter a code into a website unless they initiated the request themselves from a device they are physically holding (e.g., a Smart TV).
## Related Tools/Techniques
- **Adversary-in-the-Middle (AiTM):** A related technique using proxy servers to steal session cookies.
- **OAuth Consent Phishing:** Tricking users into granting permissions to a malicious third-party app.
- **AADInternals:** A PowerShell toolkit commonly used to perform and test these attacks.