Device code phishing
Named by 16 kept items in this workspace.
14 items name it under techniques and 2 under classification.key entities.
Search every workspace for Device code phishing. It matches the name as written, so it can find other things that share it.
The items that name it 16
Microsoft Office device-code flow from 193.26.115[.]16
Abuses Microsoft's real device code login flow; victim enters a short code on a legitimate Microsoft page, giving the attacker an access token that outlives a password reset and can be reused without reprompting; AI-accelerated
Victim sees a real GitHub URL and prompt, enters an attacker-generated code, and authorizes a token, granting the attacker access
Attacker directs victim to a legitimate device login URL (e.g. microsoft.com/devicelogin) and has them enter an attacker-supplied code, authorizing an OAuth token for the attacker's device rather than logging the victim in, granting persistent cloud access without a password
UNC7005 lured targets with event invitations such as a spoofed GLOBSEC forum to submit device codes for Microsoft and WhatsApp accounts
Technique where attackers phish victims with a pre-generated Microsoft device code (e.g. via a 'shared document' lure) to obtain authorization tokens, then use the same infrastructure to host phishing pages and perform the initial sign-in
Attackers send victims to a legitimate Microsoft sign-in flow (device code authentication) to trick them into authorizing attacker-controlled sessions; MFA may still occur and no password is phished directly, making it hard to detect via traditional credential-theft indicators.
Attacker generates a legitimate Microsoft OAuth device authorization code, embeds it in phishing lures, and captures the resulting OAuth token (valid up to 90 days) when the victim authenticates and completes MFA; sidesteps MFA rather than defeating it.
Attackers generate legitimate Microsoft device authorization codes themselves and use phishing lures to trick victims into entering attacker-controlled codes at microsoft.com/devicelogin; once the victim submits the code and approves the prompt, the attacker's backend instantly receives valid OAuth
Attackers initiate the OAuth device code authentication process themselves, then phish the victim to enter the resulting code, handing over a fully valid session token without needing a stolen password, malware, or defeating MFA.
Exploiting a legitimate Microsoft OAuth device code authentication flow to get victims to authenticate an attacker's session, bypassing password and MFA entirely
Attacker requests a legitimate device code from an identity provider's device code API, phishes the victim into visiting the legitimate device login page and entering the code plus credentials/MFA, then polls the token endpoint to retrieve the resulting access and refresh tokens for the victim
Abusing legitimate sign-in flows for cloud email services (M365) to steal tokens; GTG-20006's 'Embassy Kit' framework
All techniques in this workspace.