10 minhigh
We Need to Talk About Device Code Phishing
Device code phishing abuses the legitimate OAuth 2.0 Device Authorization Grant flow to trick users into entering attacker-generated device codes on Microsoft's legitimate login page, granting attackers valid OAuth session tokens that bypass MFA. Multiple threat actors and PhaaS platforms including Storm-2372, EvilTokens, and Kali365 have adopted this technique at scale. Mitigations center on Microsoft Entra ID Conditional Access policies to block device code flow, monitoring new device registrations, and detecting suspicious token exchange patterns in Entra ID logs.
Sens:▲ 24hConf:high
IOCs1
1filename
Detection / Hunteropenrouter
What Happened
Attackers are exploiting a legitimate Microsoft login process designed for devices like smart TVs to steal access to user accounts. Instead of stealing passwords, they generate a short code, send it to victims via convincing messages (like meeting invites or fake document notifications), and trick people into entering that code on Microsoft's real login page. Once entered, the attacker receives a valid access token that lets them into the victim's account, bypassing multi-factor authentication. Russian state hackers and criminal phishing services are both using this technique widely. Organizations using Microsoft Entra ID should enable Conditional Access policies to block the device code flow, monitor for unexpected new device registrations, and train employees to be suspicious of unsolicited codes delivered via chat platforms.
Key Takeaways
- Device code phishing abuses legitimate OAuth 2.0 Device Authorization Grant flows to steal authenticated session tokens, bypassing MFA.
- Russian threat actor Storm-2372 used WhatsApp, Signal, and Teams lures to deliver device code phishing against government, NGO, defense, telecom, healthcare, and energy sectors.
- EvilTokens PhaaS platform drove a large-scale campaign targeting 344 organizations starting March 2, 2026, using Railway.com as a token-harvesting engine to bypass Microsoft risk scoring.
- Kali365 PhaaS platform has integrated device code phishing into its service offerings, distributed via Telegram per FBI PSA I-052126-PSA.
- Microsoft Conditional Access can block device code flow, but approximately 25% of Huntress-observed customers with Conditional Access licenses have not configured policies.
Affected Systems
- Microsoft Entra ID (Azure AD)
- Microsoft 365
- OAuth 2.0 Device Authorization Grant (RFC 8628)
- Devices relying on Microsoft Device Registration Service (DRS)
Vulnerabilities (CVEs)
None identified.
Attack Chain
- Initial Contact: Attacker builds rapport with target via WhatsApp, Signal, or Microsoft Teams, impersonating prominent individuals.
- Phishing Delivery: Attacker sends a personalized lure (construction RFPs, DocuSign notifications, voicemail notifications) containing an attacker-generated device code, often via compromised websites, security vendor URL rewriters, or Cloudflare Workers pages.
- User Interaction: Victim enters the device code at microsoft.com/devicelogin or login.microsoftonline.com/common/oauth2/deviceauth, believing they are authenticating for a legitimate purpose.
- Token Theft: Attacker's backend (hosted on platforms like Railway.com for clean IP reputation) receives valid OAuth tokens instantly upon victim approval.
- Persistence/Access: Attacker uses stolen tokens to access Microsoft 365 resources, potentially registering a new device in Entra ID and exchanging Office app tokens against Azure Resource Manager.
Detection Availability
- YARA Rules: No
- Sigma Rules: No
- Snort/Suricata Rules: No
- KQL Queries: No
- Splunk SPL Queries: No
- EQL Queries: No
- Other Detection Logic: No
No detection rules are provided in the article. The article describes detection strategies conceptually: monitoring Entra ID logs for new device registrations, suspicious token exchange patterns (e.g., Office app tokens used against Azure Resource Manager), and reviewing session IDs, PRT identifiers, and token identifiers in Entra ID sign-in logs.
Detection Engineering Assessment
| Dimension | Rating | Rationale |
|---|---|---|
| EDR Visibility | Low | The attack primarily occurs through legitimate Microsoft authentication flows in the cloud. EDR agents on endpoints have limited visibility into OAuth token exchanges and Entra ID device registration events. The endpoint may only show a browser navigating to a legitimate Microsoft URL. |
| Network Visibility | Low | Network traffic flows to legitimate Microsoft endpoints (login.microsoftonline.com, microsoft.com/devicelogin). The token-harvesting backend may use legitimate PaaS platforms like Railway.com with clean IP reputations, making network-based detection difficult. Multi-hop redirect chains through compromised sites and Cloudflare Workers add complexity. |
| Detection Difficulty | Hard | The attack abuses legitimate authentication infrastructure and produces traffic indistinguishable from normal user activity at the network layer. Detection requires Entra ID log analysis for anomalous token exchange patterns, new device registrations with default machine names, and cross-resource token usage (e.g., Office tokens against Azure Resource Manager). Analysts need deep familiarity with Entra ID log schema and OAuth token flows. |
Required Log Sources
- Microsoft Entra ID sign-in logs
- Microsoft Entra ID audit logs (device registration events)
- Azure Resource Manager activity logs
- Microsoft 365 workload logs (Exchange, SharePoint, Teams)
- Conditional Access policy evaluation logs
Hunting Hypotheses
| Hypothesis | Telemetry | ATT&CK Stage | FP Risk |
|---|---|---|---|
| Consider hunting for Office application tokens being exchanged against Azure Resource Manager, as this is a key red flag indicating token abuse rather than normal usage patterns. | Microsoft Entra ID sign-in logs and Azure Resource Manager activity logs showing token exchange events with mismatched application contexts. | Credential Access / Defense Evasion | Medium — legitimate automation or service principals may exchange tokens across resources; verify whether the token's originating app context matches expected usage. |
| Consider hunting for new device registrations in Entra ID with default machine names, as attackers may not customize device names during registration. | Entra ID audit logs for device registration events, cross-referenced against known device inventory and naming conventions. | Persistence / Account Manipulation | Low to Medium — default machine names may appear in legitimate new device enrollments; correlate with user identity, location, and timing. |
| Consider hunting for sign-in events where the authentication method is device code flow and the originating IP or user agent is inconsistent with the user's normal patterns. | Entra ID sign-in logs filtered for authentication method 'device code' or device authorization grant, correlated with user baseline behavior. | Initial Access | Low — device code flow is uncommon for standard user sign-ins; legitimate uses typically involve smart TVs, IoT devices, or CLI tools and can be allowlisted. |
| Consider hunting for OAuth token exchange activity originating from PaaS infrastructure (e.g., Railway.com IP ranges) that has no prior association with the organization's user base. | Entra ID sign-in logs showing token exchange requests from cloud hosting provider IP ranges, correlated against known service accounts and expected geographic patterns. | Credential Access | Medium — developers may legitimately use PaaS platforms; correlate with whether the user has a documented reason for token exchange from that infrastructure. |
Control Gaps
- Traditional email-based phishing detection will not catch device code phishing delivered via WhatsApp, Signal, or Microsoft Teams chat messages.
- MFA does not prevent this attack because the attacker receives a valid OAuth token after the user completes authentication on their own device.
- URL reputation and web filtering will not flag the attack because users interact with legitimate Microsoft authentication endpoints.
- EDR endpoint detection has minimal visibility since the compromise occurs in the cloud authentication layer.
- Conditional Access policies that are licensed but not configured provide no protection.
Key Behavioral Indicators
- Device code flow authentication events in Entra ID sign-in logs for users who do not normally use device-limited input devices.
- New device registrations in Entra ID with default or generic machine names shortly after a device code flow authentication.
- OAuth tokens issued to Office applications subsequently used to access Azure Resource Manager resources.
- Token exchange requests originating from cloud PaaS provider IP ranges (e.g., Railway.com) with no prior organizational association.
- Multi-hop URL redirect chains through compromised websites, security vendor URL rewriters, and Cloudflare Workers pages leading to device code prompts.
False Positive Assessment
Medium — Device code flow is a legitimate authentication mechanism used by smart TVs, IoT devices, CLI tools, and other input-constrained devices. Blocking or alerting on all device code flow activity may generate false positives for legitimate users. Correlating with user behavior baselines, device naming patterns, and token exchange contexts reduces but does not eliminate false positive risk.
Recommendations
Immediate Mitigation
defender takeaway
- Verify against your organization's incident response runbook and team escalation paths before acting. Consider reviewing Entra ID sign-in logs for device code flow authentication events over the past 30-90 days to identify potential compromises.
- If your organization has Conditional Access licenses, evaluate whether a policy blocking device code flow can be enabled. Plan for exceptions required by the Device Registration Service (DRS) before enforcement.
- Consider auditing Entra ID for recently registered devices, especially those with default machine names or registrations outside expected geographic regions and time windows.
- If suspicious token activity is identified, consider revoking OAuth tokens for affected users via Entra ID admin center or PowerShell.
Infrastructure Hardening
- Consider disabling device code flow entirely in Entra ID if no business use case requires it, weighing operational impact against security benefit.
- Evaluate whether device writeback can be disabled in Entra ID if it is not required, to prevent device registration abuse.
- Consider implementing Conditional Access policies that restrict token exchange based on device compliance, location, and risk signals.
- If applicable, consider blocking or monitoring traffic to PaaS platforms (e.g., Railway.com) from accounts that have no documented development use case.
User Protection
- Consider training employees to treat unsolicited device codes delivered via chat platforms (WhatsApp, Signal, Teams) as suspicious, especially when received from unknown or impersonated contacts.
- Consider adding device code phishing examples to existing security awareness training programs, emphasizing that legitimate Microsoft login pages can be abused in this attack.
- If supported by your messaging platforms, consider implementing external sender warnings and verification for messages claiming to be from prominent individuals.
Security Awareness
- Consider incorporating device code phishing scenarios into phishing simulation exercises, using chat-based lures in addition to email-based ones.
- Consider briefing help desk and IT support staff on device code phishing so they can recognize and escalate reports of users receiving unsolicited authentication codes.
- If applicable, consider updating acceptable use policies to address the risk of authenticating device codes received through unsolicited communications.
MITRE ATT&CK Mapping
MITRE ATT&CK Mapping4 techniques
Tactic
Initial Access
Tactic
Persistence
Tactic
Credential Access
Additional IOCs
- Other:
I-052126-PSA- FBI Public Service Announcement number for Kali365 PhaaS platform using device code phishing, dated May 21, 2026. Reference identifier for the FBI alert.
Showing defanged values
- filenameAgreement_Review.pdfPhishing lure document filename displayed in a device code phishing lure shown in the article. Used as a social engineering pretext to convince victims to enter attacker-generated device codes.