Attackers use device code phishing via fake Microsoft Teams scheduler to steal session tokens
A construction company employee was targeted with a sophisticated phishing campaign abusing Microsoft Teams device code login. Attackers sent an email from a typosquatted domain impersonating a senior executive, leading victims to a fake Teams meeting scheduler. The lure tricked victims into entering a Microsoft device code on a genuine Microsoft login page, handing attackers valid access tokens. The phishing kit employed AES-256-GCM encryption to evade email scanners and retried sign-ins to bypass MFA prompts. Huntress discovered the attack by detecting suspicious sign-in behavior and advises monitoring device code authentication, implementing phishing-resistant MFA, and scrutinizing unfamiliar device sign-ins to mitigate such threats.
Detalhes técnicos
The phishing kit encrypts the lure page content with AES-256-GCM, decrypting via JavaScript at runtime to evade scanners that do not execute scripts. The fake scheduler displays a device code presented as a "Booking Reference," urging rapid victim action. The attacker uses residential proxies for legitimate-looking login traffic. When MFA steps generate errors, the phishing flow automatically retries with new device codes to overcome the hurdle. The initial access vector is a typosquatted email domain with links redirecting from Google sharing links to the phishing page, bypassing URL reputation filters.
Remediação
Huntress recommends treating unexpected Microsoft device code prompts with suspicion and restricting device code authentication with conditional access policies if not required. Deploy phishing-resistant MFA methods to reduce risk. After detection, investigate sign-in logs for automation indicators and check for unauthorized MFA methods, unknown devices, app permissions, mailbox rules, and outbound mail activity.
Linha do tempo
-
Attackers use device code phishing via fake Microsoft Teams scheduler to steal session tokens
ler a análise desta fonte ocultar
A construction company employee was targeted with a sophisticated phishing campaign abusing Microsoft Teams device code login. Attackers sent an email from a typosquatted domain impersonating a senior executive, leading victims to a fake Teams meeting scheduler. The lure tricked victims into entering a Microsoft device code on a genuine Microsoft login page, handing attackers valid access tokens. The phishing kit employed AES-256-GCM encryption to evade email scanners and retried sign-ins to bypass MFA prompts. Huntress discovered the attack by detecting suspicious sign-in behavior and advises monitoring device code authentication, implementing phishing-resistant MFA, and scrutinizing unfamiliar device sign-ins to mitigate such threats.
Technical Details
The phishing kit encrypts the lure page content with AES-256-GCM, decrypting via JavaScript at runtime to evade scanners that do not execute scripts. The fake scheduler displays a device code presented as a "Booking Reference," urging rapid victim action. The attacker uses residential proxies for legitimate-looking login traffic. When MFA steps generate errors, the phishing flow automatically retries with new device codes to overcome the hurdle. The initial access vector is a typosquatted email domain with links redirecting from Google sharing links to the phishing page, bypassing URL reputation filters.
Remediation
Huntress recommends treating unexpected Microsoft device code prompts with suspicion and restricting device code authentication with conditional access policies if not required. Deploy phishing-resistant MFA methods to reduce risk. After detection, investigate sign-in logs for automation indicators and check for unauthorized MFA methods, unknown devices, app permissions, mailbox rules, and outbound mail activity.