Advanced Microsoft Teams-themed Device Code Phishing Campaign Evades Detection with Meeting Booking Flow
Huntress has identified a sophisticated device code phishing campaign targeting Microsoft 365 users, employing a uniquely crafted Microsoft Teams meeting booking workflow as a social engineering lure. The attack begins with a spear-phishing email impersonating a senior executive and uses a multi-stage redirect chain to a typosquatted domain designed to mimic a Teams calendar meeting setup. Victims are tricked into copying a device code disguised as a "Booking Reference" and entering it into Microsoft's legitimate device-login page, thereby authorizing attacker access tokens without triggering suspicion. This operation uses encrypted phishing kits, fallback mechanisms for MFA challenges, and residential proxies to obfuscate attacker infrastructure and avoid detection. The campaign demonstrates evolving attacker tactics that blend legitimate authentication processes with realistic lures, increasing the likelihood of successful token theft and session hijacking.
Linha do tempo
-
Advanced Microsoft Teams-themed Device Code Phishing Campaign Evades Detection with Meeting Booking Flow
ler a análise desta fonte ocultar
Huntress has identified a sophisticated device code phishing campaign targeting Microsoft 365 users, employing a uniquely crafted Microsoft Teams meeting booking workflow as a social engineering lure. The attack begins with a spear-phishing email impersonating a senior executive and uses a multi-stage redirect chain to a typosquatted domain designed to mimic a Teams calendar meeting setup. Victims are tricked into copying a device code disguised as a "Booking Reference" and entering it into Microsoft's legitimate device-login page, thereby authorizing attacker access tokens without triggering suspicion. This operation uses encrypted phishing kits, fallback mechanisms for MFA challenges, and residential proxies to obfuscate attacker infrastructure and avoid detection. The campaign demonstrates evolving attacker tactics that blend legitimate authentication processes with realistic lures, increasing the likelihood of successful token theft and session hijacking.