6 minhigh
Beyond the Login Field: The Evolved Phishing Tradecraft Your Users Aren't Ready For
Adversaries have evolved phishing tradecraft to bypass MFA and traditional security awareness training by abusing legitimate system tools and cloud authentication flows. Techniques include ClickFix (terminal execution via fake CAPTCHA), Browser-in-the-Browser (HTML-rendered fake windows), OAuth consent phishing, device code flow abuse, and fake video conference overlays. These methods exploit user trust in legitimate infrastructure and routine troubleshooting habits to deploy malware or hijack authentication tokens.
Conf:high
Showing defanged values
- domainbusinessnotice[.]orgPhishing domain used in a Browser-in-the-Browser (BitB) attack targeting Microsoft credentials.
- domainsecuritynotifications[.]orgPhishing domain used in a device code flow phishing attack spoofing Microsoft.
- domainsecurity-updater[.]comPhishing domain used in an OAuth consent phishing attack (ConsentFix) targeting Microsoft Entra ID.
- urlhxxps://phishingdefense[.]org/phishing/browser-slack?trial=1Demo URL for Browser-in-the-Browser (BitB) phishing simulation.
- urlhxxps://phishingdefense[.]org/phishing/command-execution-demo?trial=1Demo URL for ClickFix phishing simulation.
- urlhxxps://phishingdefense[.]org/phishing/consentfix-demo?trial=1Demo URL for ConsentFix OAuth phishing simulation.
- urlhxxps://phishingdefense[.]org/phishing/device-code?trial=1Demo URL for device code phishing simulation.
- urlhxxps://phishingdefense[.]org/phishing/fake-meet-teams?trial=1Demo URL for fake video conference overlay phishing simulation.
Detection / Hunteropenrouter
What Happened
Attackers are using new phishing methods that trick people into bypassing security measures themselves. Instead of stealing passwords, they manipulate users into running malicious code by pretending it is a CAPTCHA verification or a software update. They also create fake browser windows that look real to steal login information. Some attacks abuse legitimate Microsoft login pages to authorize attacker devices without the user knowing. People should be cautious of unexpected prompts to run commands, enter codes, or update software during virtual meetings. Organizations should update their security training to include these modern threats.
Key Takeaways
- Attackers are bypassing MFA using advanced social engineering like ClickFix, BitB, and OAuth consent phishing rather than traditional credential harvesting.
- ClickFix attacks trick users into pasting malicious commands into their terminal via fake CAPTCHA prompts, bypassing browser download warnings.
- Browser-in-the-Browser (BitB) attacks render fake browser windows inside legitimate webpages to steal credentials and MFA tokens.
- Device code phishing abuses legitimate OAuth flows (e.g., microsoft.com/devicelogin) to authorize attacker-controlled devices without needing passwords.
- Fake video conference overlays use simulated meeting environments to trick users into downloading malware disguised as driver or app updates.
Affected Systems
- Web browsers
- Microsoft Entra ID (Azure AD)
- Microsoft Teams
- macOS Terminal
- Windows PowerShell
Vulnerabilities (CVEs)
None identified.
Attack Chain
- Initial Access: Phishing email delivers link to a fake CAPTCHA, fake meeting, or legitimate OAuth login page.
- Execution: User is tricked into pasting a malicious command into their terminal (ClickFix) or downloading a fake driver update (Fake VTC).
- Credential Access: User enters credentials into a simulated browser window (BitB) or authorizes an OAuth token for an attacker device (Device Code Phishing).
- Persistence: Attacker uses stolen OAuth tokens or installed RMM tools for long-term access.
Detection Availability
- YARA Rules: No
- Sigma Rules: No
- Snort/Suricata Rules: No
- KQL Queries: No
- Splunk SPL Queries: No
- EQL Queries: No
- Other Detection Logic: No
No detection rules are provided in the article. It focuses on security awareness training simulations.
Detection Engineering Assessment
copy:
| Dimension | Rating | Rationale |
|---|---|---|
| EDR Visibility | Medium | EDR can detect execution of commands from pasted clipboard content and the installation of fake RMM tools, but may miss OAuth token theft occurring entirely in the browser. |
| Network Visibility | Low | Attacks abuse legitimate domains (e.g., microsoft.com/devicelogin) and standard HTTPS traffic, making network-level detection difficult without proxy inspection of specific parameters. |
| Detection Difficulty | Hard | Distinguishing between legitimate user OAuth consent and malicious consent grants requires context and identity analytics. ClickFix relies on user-initiated execution, blurring the line between user action and compromise. |
Required Log Sources
- EDR process execution logs
- Clipboard access logs
- OAuth audit logs (Microsoft Entra ID)
- Email gateway logs
Hunting Hypotheses
copy:
| Hypothesis | Telemetry | ATT&CK Stage | FP Risk |
|---|---|---|---|
| Consider hunting for processes like PowerShell or Terminal executing shortly after a browser process receives clipboard paste events, indicating a potential ClickFix attack. | EDR process telemetry, clipboard access monitoring | Execution | Medium - Users may legitimately paste commands from web tutorials. |
| Consider hunting for OAuth consent grants to applications with suspicious names or from unfamiliar IP addresses in Microsoft Entra ID audit logs. | Microsoft Entra ID audit logs | Credential Access | Low - Unfamiliar OAuth grants are typically suspicious in enterprise environments. |
| Consider hunting for device code authentication flows originating from unexpected locations or user accounts. | Microsoft Entra ID sign-in logs | Persistence | Low - Device code flow is less common in standard corporate workflows. |
| Consider hunting for the download and execution of .msi or .scr files from browser processes, particularly those masquerading as driver updates. | EDR file creation and process execution logs | Execution | Medium - Legitimate software updates may use similar file types. |
Control Gaps
- Secure Email Gateways (SEGs) may not block emails containing links to legitimate domains like microsoft.com/devicelogin.
- Traditional URL filtering may not block phishing sites using legitimate SSL certificates or HTML-rendered fake windows.
- MFA does not prevent token theft or illicit OAuth consent grants.
Key Behavioral Indicators
- Execution of PowerShell or Terminal commands via clipboard paste from a browser context
- OAuth consent grants to unverified or newly registered applications
- Device code authentication flows initiated outside of expected IT management workflows
- Execution of .msi or .scr files downloaded from web browsers under the guise of driver updates
False Positive Assessment
Medium - Behavioral indicators like clipboard-to-terminal execution or OAuth consent grants may have legitimate uses in development or IT workflows, requiring context for accurate detection.
Recommendations
Immediate Mitigation
defender takeaway
- Verify against your organization's incident response runbook and team escalation paths before acting. Consider reviewing recent OAuth consent grants in Microsoft Entra ID for suspicious applications.
- Consider blocking the identified phishing domains (businessnotice.org, security-updater.com, securitynotifications.org) at your web proxy or DNS sinkhole.
Infrastructure Hardening
- Evaluate whether conditional access policies can restrict OAuth consent grants to pre-approved applications only.
- Consider disabling or restricting device code flow authentication if it is not required by your organization's workflows.
- If supported by your email gateway, consider implementing policies that flag or block emails containing device codes.
User Protection
- Consider updating security awareness training to include simulations of ClickFix, BitB, OAuth consent phishing, and device code phishing.
- Consider training users to never enter codes they did not personally generate and to be suspicious of unexpected driver update prompts during virtual meetings.
Security Awareness
- Consider rolling into existing awareness programs the concept of 'check the URL' being insufficient and the need to verify the context of authentication prompts.
- Consider training users to drag pop-up windows to see if they are fake browser elements (BitB detection).
MITRE ATT&CK Mapping
MITRE ATT&CK Mapping5 techniques
Tactic
Execution
Tactic
Persistence
Tactic
Credential Access
Tactic
Collection
Additional IOCs
- Urls:
hxxps://phishingdefense[.]org/phishing/command-execution-demo?trial=1- Demo URL for ClickFix phishing simulation.hxxps://phishingdefense[.]org/phishing/browser-slack?trial=1- Demo URL for Browser-in-the-Browser (BitB) phishing simulation.hxxps://phishingdefense[.]org/phishing/consentfix-demo?trial=1- Demo URL for ConsentFix OAuth phishing simulation.hxxps://phishingdefense[.]org/phishing/device-code?trial=1- Demo URL for device code phishing simulation.hxxps://phishingdefense[.]org/phishing/fake-meet-teams?trial=1- Demo URL for fake video conference overlay phishing simulation.
- Command Lines:
- Purpose: Executing pasted clipboard payload from a fake CAPTCHA prompt | Tools:
Terminal,PowerShell| Stage: Execution |Win + R, Ctrl + V, Enter
- Purpose: Executing pasted clipboard payload from a fake CAPTCHA prompt | Tools:
