Teams-themed device code phishing campaign hijacks Microsoft 365 sessions via fake meeting booking flow, found by Huntress
Matéria consolidada. Reúne 2 matérias que o Tifon tinha publicado separadamente sobre a mesma história. A IA reescreveu o relatório com o que as 2 fontes trouxeram em 13/11/2026 12:06; os links antigos trazem para cá.
Fontes: huntress.com ↗ helpnetsecurity.com ↗
Huntress (huntress.com) identified a device code phishing campaign against Microsoft 365 users that uses a fake Microsoft Teams meeting booking workflow as its lure. The attack starts with a spear-phishing email impersonating a senior executive and sent from a typosquatted domain (huntress.com, helpnetsecurity.com). Victims are sent through a multi-stage redirect chain to a fake Teams calendar scheduler. There they are tricked into copying a device code, presented as a "Booking Reference", into Microsoft's legitimate device-login page. This hands the attacker valid access tokens and enables session hijacking (huntress.com). The observed target was an employee of a construction company, and Huntress found the activity by detecting suspicious sign-in behavior (helpnetsecurity.com). The coverage (huntress.com, helpnetsecurity.com) names no threat actor and gives no IOCs.
Detalhes técnicos
- Initial access: the email comes from a typosquatted domain impersonating a senior executive. Links redirect from Google sharing links to the phishing page, which helps bypass URL reputation filters (helpnetsecurity.com). The chain has several redirect stages (huntress.com).
- Lure: a fake Teams meeting scheduler shows the device code as a "Booking Reference" and urges the victim to act quickly. The code is entered on the genuine Microsoft device-login page, so the victim sees nothing suspicious (huntress.com, helpnetsecurity.com).
- Evasion: the phishing kit encrypts the lure page content with AES-256-GCM and decrypts it with JavaScript at runtime. This evades scanners that do not execute scripts (helpnetsecurity.com, huntress.com).
- MFA handling: when MFA steps cause errors, the flow automatically retries sign-in with new device codes (helpnetsecurity.com). Huntress also describes fallback mechanisms for MFA challenges (huntress.com).
- Infrastructure: residential proxies make the login traffic look legitimate and obscure the attacker infrastructure (huntress.com, helpnetsecurity.com).
Remediação
- Treat unexpected Microsoft device code prompts as suspicious (helpnetsecurity.com).
- Restrict device code authentication with conditional access policies if it is not required (helpnetsecurity.com).
- Deploy phishing-resistant MFA methods and scrutinize sign-ins from unfamiliar devices (helpnetsecurity.com).
- After detection, review sign-in logs for automation indicators. Check for unauthorized MFA methods, unknown devices, app permissions, mailbox rules and outbound mail activity (helpnetsecurity.com).
Linha do tempo
-
Advanced Microsoft Teams-themed Device Code Phishing Campaign Evades Detection with Meeting Booking Flow
ler a análise desta fonte ocultar
Huntress has identified a sophisticated device code phishing campaign targeting Microsoft 365 users, employing a uniquely crafted Microsoft Teams meeting booking workflow as a social engineering lure. The attack begins with a spear-phishing email impersonating a senior executive and uses a multi-stage redirect chain to a typosquatted domain designed to mimic a Teams calendar meeting setup. Victims are tricked into copying a device code disguised as a "Booking Reference" and entering it into Microsoft's legitimate device-login page, thereby authorizing attacker access tokens without triggering suspicion. This operation uses encrypted phishing kits, fallback mechanisms for MFA challenges, and residential proxies to obfuscate attacker infrastructure and avoid detection. The campaign demonstrates evolving attacker tactics that blend legitimate authentication processes with realistic lures, increasing the likelihood of successful token theft and session hijacking.
-
Attackers use device code phishing via fake Microsoft Teams scheduler to steal session tokens
ler a análise desta fonte ocultar
A construction company employee was targeted with a sophisticated phishing campaign abusing Microsoft Teams device code login. Attackers sent an email from a typosquatted domain impersonating a senior executive, leading victims to a fake Teams meeting scheduler. The lure tricked victims into entering a Microsoft device code on a genuine Microsoft login page, handing attackers valid access tokens. The phishing kit employed AES-256-GCM encryption to evade email scanners and retried sign-ins to bypass MFA prompts. Huntress discovered the attack by detecting suspicious sign-in behavior and advises monitoring device code authentication, implementing phishing-resistant MFA, and scrutinizing unfamiliar device sign-ins to mitigate such threats.
Technical Details
The phishing kit encrypts the lure page content with AES-256-GCM, decrypting via JavaScript at runtime to evade scanners that do not execute scripts. The fake scheduler displays a device code presented as a "Booking Reference," urging rapid victim action. The attacker uses residential proxies for legitimate-looking login traffic. When MFA steps generate errors, the phishing flow automatically retries with new device codes to overcome the hurdle. The initial access vector is a typosquatted email domain with links redirecting from Google sharing links to the phishing page, bypassing URL reputation filters.
Remediation
Huntress recommends treating unexpected Microsoft device code prompts with suspicion and restricting device code authentication with conditional access policies if not required. Deploy phishing-resistant MFA methods to reduce risk. After detection, investigate sign-in logs for automation indicators and check for unauthorized MFA methods, unknown devices, app permissions, mailbox rules, and outbound mail activity.