Huntress analyzes three Microsoft 365 phishing kits, including EvilTokens and Kali365, built for device-code and AitM token theft
Huntress analysts presented findings on three recently staged phishing kits that target Microsoft 365 authentication tokens, as part of its October Tradecraft Tuesday series. The kits include EvilTokens, a device-code phishing campaign that abused the Railway PaaS for token harvesting and replay, and the Kali365 control panel, described as a criminal ecosystem that includes AI features. A joint effort by Microsoft's Digital Crimes Unit and the FBI recently led to the arrest of one alleged EvilTokens operator. Huntress estimates that one in six incidents investigated by its ITDR team involved a rogue device registration. The talk argues that stolen session tokens and persistent footholds are now more valuable to attackers than passwords, and that successfully completed MFA does not make a session trustworthy.
Detalhes técnicos
- Phishing kits range from simple HTML/script fake login pages to advanced kits with admin dashboards for victim tracking, page modification and real-time credential relay.
- Device-code phishing: the victim authenticates directly with the identity provider while the attacker captures the resulting authorization, so no password is surrendered. 36% of polled audience members had seen it in the wild.
- Adversary-in-the-middle (AitM): the attacker relays the authentication flow in real time through a fake login page or by intercepting an exchange in the legitimate app. The victim completes MFA while the attacker captures the session information. The token is then replayed into an active session to access cloud resources and victim mailboxes.
- EvilTokens was noted for a professional, SaaS-like operation with 24/7 support.
- Detection requires correlating the chain: lure, authentication, token issuance or theft, device registration, and mailbox activity across identity provider, endpoint, browser, network and mailbox telemetry.
Remediação
- Restrict or block device-code flow with Conditional Access Policies; most Microsoft environments do not need it.
- Investigate successful sign-ins from unfamiliar cloud infrastructure, and hunt for device-code authentication and automated token refresh.
- Review new devices, authentication methods, and mailbox activity, including forwarding rules and outbound phishing.
- Remove unauthorized devices and Windows Hello credentials, and revoke persistence mechanisms.
- Contain identity artifacts, not just the original lure, and continue hunting after the phishing domain disappears, monitoring for replay or re-entry.
Linha do tempo
-
Huntress analyzes three Microsoft 365 phishing kits, including EvilTokens and Kali365, built for device-code and AitM token theft
ler a análise desta fonte ocultar
Huntress analysts presented findings on three recently staged phishing kits that target Microsoft 365 authentication tokens, as part of its October Tradecraft Tuesday series. The kits include EvilTokens, a device-code phishing campaign that abused the Railway PaaS for token harvesting and replay, and the Kali365 control panel, described as a criminal ecosystem that includes AI features. A joint effort by Microsoft's Digital Crimes Unit and the FBI recently led to the arrest of one alleged EvilTokens operator. Huntress estimates that one in six incidents investigated by its ITDR team involved a rogue device registration. The talk argues that stolen session tokens and persistent footholds are now more valuable to attackers than passwords, and that successfully completed MFA does not make a session trustworthy.
Technical Details
- Phishing kits range from simple HTML/script fake login pages to advanced kits with admin dashboards for victim tracking, page modification and real-time credential relay.
- Device-code phishing: the victim authenticates directly with the identity provider while the attacker captures the resulting authorization, so no password is surrendered. 36% of polled audience members had seen it in the wild.
- Adversary-in-the-middle (AitM): the attacker relays the authentication flow in real time through a fake login page or by intercepting an exchange in the legitimate app. The victim completes MFA while the attacker captures the session information. The token is then replayed into an active session to access cloud resources and victim mailboxes.
- EvilTokens was noted for a professional, SaaS-like operation with 24/7 support.
- Detection requires correlating the chain: lure, authentication, token issuance or theft, device registration, and mailbox activity across identity provider, endpoint, browser, network and mailbox telemetry.
Remediation
- Restrict or block device-code flow with Conditional Access Policies; most Microsoft environments do not need it.
- Investigate successful sign-ins from unfamiliar cloud infrastructure, and hunt for device-code authentication and automated token refresh.
- Review new devices, authentication methods, and mailbox activity, including forwarding rules and outbound phishing.
- Remove unauthorized devices and Windows Hello credentials, and revoke persistence mechanisms.
- Contain identity artifacts, not just the original lure, and continue hunting after the phishing domain disappears, monitoring for replay or re-entry.