Device code phishing abuses the legitimate OAuth 2.0 Device Authorization Grant flow to trick users into entering attacker-generated device codes on Microsoft's legitimate login page, granting attackers valid OAuth session tokens that bypass MFA. Multiple threat actors and PhaaS platforms including Storm-2372, EvilTokens, and Kali365 have adopted this technique at scale. Mitigations center on Microsoft Entra ID Conditional Access policies to block device code flow, monitoring new device registrations, and detecting suspicious token exchange patterns in Entra ID logs.
OAuth Abuse
12 posts
We Need to Talk About Device Code Phishing 20th July – Threat Intelligence Report This weekly threat intelligence report covers major breaches including Ernst & Young, Coca-Cola's Fairlife subsidiary, and Nihon Kotsu, along with a Jscrambler npm supply chain compromise. Six critical CVEs were disclosed across Microsoft, WordPress, and SonicWall products, with four under active exploitation by ransomware operators. AI-enabled threats are highlighted including China-linked actors using Claude Code and DeepSeek for automated attack generation, and weaknesses in AI coding assistants exposing source code and credentials. Threat actor campaigns from ShinyHunters, CylindricalCanine/GoldenEyeDog, and Spirals ransomware are also documented.
June 2026 Threat Trend Report on APT Groups The June 2026 APT trend report documents activity from 20 state-sponsored threat groups across North Korea, China, Russia, Iran, India, and Southeast Asia. A significant evolution is observed: groups are increasingly abusing legitimate cloud services (GitHub, Google Drive, Dropbox, Zoho WorkDrive), OAuth tokens, generative AI, and MaaS platforms rather than relying solely on custom malware. Supply chain compromises (notably the Mastra npm ecosystem), DLL sideloading, and cloud-based C2 channels are now standard TTPs across multiple regions, complicating traditional detection approaches.
The Hacker’s 2026 Playbook from the Dark Web The article details two evolving social engineering techniques: ClickFix, which tricks users into pasting and executing attacker-supplied PowerShell commands via fake prompts, and ConsentFix, which abuses Microsoft 365 OAuth consent flows by manipulating users into dragging a localhost callback link into the browser to capture session tokens. A complete ConsentFix playbook with working code was publicly shared on a Russian cybercrime forum, enabling widespread adoption. Both techniques bypass traditional security controls by exploiting user muscle memory and legitimate platform infrastructure.
It Took Five Minutes to Turn a Standard User Into a Global Admin Huntress demonstrated that a standard Microsoft 365 user with no admin privileges can be escalated to Global Administrator in under six minutes by exploiting common identity misconfigurations — specifically, an over-privileged service account owning an enterprise application, lack of MFA enforcement, and standard users being permitted to access the Azure portal. Analysis of 12,000+ M365 tenants revealed that over 60% were missing at least half of recommended security controls, with MFA gaps, over-privileged accounts, and admin restriction failures being the most prevalent issues. The article argues that continuous, automated identity posture management is essential because configuration drift creates exploitable windows far shorter than the 24-hour scan cycles of traditional tools.
From Token Bingo to MAX Takeover: Kali365 Operator Expands Operation Across Microsoft Outlook, Okta, Xerox DocuShare, and Other Services The operators behind the Kali365 Phishing-as-a-Service (PhaaS) kit have expanded their infrastructure to target a wider array of services, including Microsoft 365, Okta, and Russia's MAX Messenger. The threat actors utilize OAuth 2.0 device authorization grant abuse and fake prize-claim lures to bypass MFA and exfiltrate credentials via Telegram.
Top 5 Phishing-Driven Social Engineering Attacks on Companies in 2026 Modern social engineering attacks have evolved to closely mimic legitimate business workflows, utilizing techniques like ClickFix, OAuth device code abuse, and in-browser blob phishing. These tactics bypass traditional security controls and create "gray-zone" alerts that require deep behavioral analysis to determine the true scope of compromise, such as credential theft, token abuse, or RMM deployment.
Social Engineering Leveled Up. Has Your Security Program? The article highlights the evolution of social engineering tactics, emphasizing how attackers abuse trusted workflows, AI platforms, and legitimate infrastructure like OAuth to bypass traditional security controls. Key threats include device code phishing campaigns like EvilTokens that bypass MFA for persistent access, and AI chatbot lures tricking macOS users into executing AMOS infostealer payloads via malicious terminal commands.
How Unified EDR and ITDR Stop Attacks Before They Spread Huntress details the operational benefits of unifying EDR and ITDR to combat infostealers and rapid credential abuse. A highlighted incident demonstrates a ClickFix social engineering attack leveraging WebDAV and rundll32.exe to execute a remote payload, which was mitigated by automatically isolating the host and revoking associated Microsoft 365 identity sessions.
Token Bingo: Don’t Let Your Code be the Winner A widespread phishing campaign is leveraging the Kali365 Live Phishing-as-a-Service (PhaaS) platform to execute device code phishing and AiTM attacks. By tricking users into authorizing legitimate Microsoft device login requests, threat actors steal OAuth access and refresh tokens, bypassing traditional credential-based defenses and MFA to gain persistent access to Microsoft 365 environments.
The Vercel Breach: The Steps To Take Now to Protect Your Organization On April 19, 2026, Vercel disclosed a critical security breach originating from a compromised third-party AI tool, Context.ai. The threat actor, ShinyHunters, utilized an infostealer to harvest OAuth tokens, bypassed MFA to access Vercel's Google Workspace, and pivoted via SSO to bulk-extract customer environment variables containing highly sensitive cloud, database, and source code credentials.
OpenClaw, Rogue Agents, and Application Hygiene The rapid adoption of AI agents like OpenClaw has introduced a new identity threat surface in Microsoft cloud environments. These applications are often granted sweeping tenant-wide permissions, effectively acting as highly privileged service principals that bypass traditional endpoint defenses and could allow attackers to inherit administrative control if the agent is compromised.
