(arcticwolf.com) Large-Scale Device Code Phishing Campaign Abusing OAuth and Phishing-as-a-Service Infrastructure
New large-scale device code phishing campaign abuses OAuth 2.0 Device Authorization Grant to compromise Microsoft 365 accounts. Threat actors leverage Kali365 Live PhaaS platform for automated token theft and post-exploitation.
In brief - Arctic Wolf uncovered a sophisticated phishing campaign targeting multiple sectors, exploiting OAuth device code flow via Kali365 Live PhaaS. Attackers bypass MFA, steal tokens, and create malicious inbox rules to evade detection. Multi-tenant infrastructure and Cloudflare Workers enable scalable operations.
Technically - The campaign abuses the OAuth 2.0 Device Code flow (RFC 8628) to obtain access/refresh tokens without handling credentials or MFA directly. Kali365 Live, a three-tier PhaaS platform, automates lure generation (PDF/Word/Excel/PPT), token theft, and post-compromise actions. Affiliates share captured tokens server-side, enabling persistent Microsoft 365 access. Infrastructure includes Cloudflare Workers for hosting and Telegram-based C2. Post-compromise: inbox rules suppress security alerts; Electron malware manages tokens. IoCs include IPs sharing identical TLS certificates. Requires monitoring OAuth flows and enforcing conditional access policies.
Source: arcticwolf.com/resources/blog/…
#Cybersecurity #ThreatIntel
Arctic Wolf recently observed a large scale device code phishing campaign leveraging the Kali365 phishing‑as‑a‑service platform to obtain initial access and conduct follow-on activity.
Arctic Wolf Labs (Arctic Wolf)
Lorenzo
Unknown parent • •GNU/Linux Italia reshared this.