{"id":1983,"date":"2025-02-14T10:03:40","date_gmt":"2025-02-14T10:03:40","guid":{"rendered":"https:\/\/serisec.com\/index.php\/2025\/02\/14\/new-device-code-phishing-attack-exploit-device-code-authentication-to-capture-authentication-tokens\/"},"modified":"2025-02-14T10:03:40","modified_gmt":"2025-02-14T10:03:40","slug":"new-device-code-phishing-attack-exploit-device-code-authentication-to-capture-authentication-tokens","status":"publish","type":"post","link":"https:\/\/serisec.com\/index.php\/2025\/02\/14\/new-device-code-phishing-attack-exploit-device-code-authentication-to-capture-authentication-tokens\/","title":{"rendered":"New Device Code Phishing Attack Exploit Device Code Authentication To Capture Authentication Tokens"},"content":{"rendered":"

New Device Code Phishing Attack Exploit Device Code Authentication To Capture Authentication Tokens
\n \t

\n
<\/BR>
\n
\n \t

\n
<\/BR><\/p>\n

\n

A sophisticated phishing campaign, identified by Microsoft Threat Intelligence, has been exploiting a technique known as \u201cdevice code phishing\u201d to capture authentication tokens.<\/p>\n

This attack, attributed to a group called Storm-2372, has been active since August 2024 and targets a wide range of industries and governments globally.<\/p>\n

The campaign uses a phishing technique<\/a> that tricks users into logging into productivity apps, allowing the attackers to capture authentication tokens that can be used to access compromised accounts.<\/p>\n

Device code authentication is a method used to authenticate accounts from devices that cannot perform interactive web-based authentication.<\/p>\n

Security experts at Microsoft noted<\/a> that it involves entering a numeric or alphanumeric code on a separate device to sign in. In device code phishing, attackers generate a legitimate device code request and deceive targets into entering it on a legitimate sign-in page.<\/p>\n

This grants the attackers access to authentication and refresh tokens, which they can use to access the target\u2019s accounts and data without needing a password.<\/p>\n

\n
\"\"
Device code phishing attack cycle (Source \u2013 Microsoft)<\/figcaption><\/figure>\n<\/div>\n

Storm-2372\u2019s Tactics<\/strong><\/h2>\n

Storm-2372\u2019s campaign involves creating lures that resemble messaging app experiences, such as WhatsApp, Signal, and Microsoft Teams<\/a>.<\/p>\n

The attackers pose as prominent individuals to build rapport with targets before sending phishing emails that appear to be meeting invitations.<\/p>\n

These invitations prompt users to authenticate using a device code, which the attackers use to capture valid access tokens.<\/p>\n

\n
\"\"
Sample Messages from the Threat Actor (Source \u2013 Microsoft)<\/figcaption><\/figure>\n<\/div>\n

After obtaining access tokens, Storm-2372 uses them to move laterally within compromised networks and harvest emails using Microsoft Graph.<\/p>\n

The attackers search for keywords like \u201cusername,\u201d \u201cpassword,\u201d and \u201ccredentials\u201d in compromised accounts.<\/p>\n

\n
\"\"
Example of Lure Used in Phishing Campaign (Source \u2013 Microsoft)<\/figcaption><\/figure>\n<\/div>\n

Example Hunting Query for Microsoft Defender XDR:-<\/p>\n

let suspiciousUserClicks = materialize(UrlClickEvents\n    where ActionType in (\"ClickAllowed\", \"UrlScanInProgress\", \"\u2026\")\n    where UrlChain has_any (\"microsoft.com\/devicelogin\", \"login\u2026\")\n    extend AccountUpn = tolower(AccountUpn)\n    project ClickTime = Timestamp, ActionType, UrlChain, Network\u2026<\/code><\/pre>\n
To defend against device code phishing attacks, organizations should restrict the use of device code flows, educate users on phishing tactics, and enforce strong authentication measures<\/a> such as MFA and phishing-resistant methods like FIDO Tokens.<\/p>\n
Implementing Conditional Access policies to monitor risky sign-ins and centralizing identity management can further enhance security.<\/p>\n
Investigate Real-World Malicious Links & Phishing Attacks With\u00a0Threat Intelligence Lookup<\/strong>\u00a0-\u00a0Try for Free<\/a><\/code><\/strong><\/code><\/strong><\/p>\n
The post New Device Code Phishing Attack Exploit Device Code Authentication To Capture Authentication Tokens<\/a> appeared first on Cyber Security News<\/a>.<\/p>\n<\/div>\n
 \t

\n 
<\/BR>
\n    Tushar Subhra Dutta
\n \t

\n
<\/BR>
\nGo to cyber-security-news<\/a>
\n \t

\n 
<\/BR><\/p>\n","protected":false},"excerpt":{"rendered":"
New Device Code Phishing Attack Exploit Device Code Authentication To Capture Authentication Tokens A sophisticated phishing campaign, identified by Microsoft Threat Intelligence, has been exploiting a technique known as \u201cdevice code phishing\u201d to capture authentication tokens. This attack, attributed to a group called Storm-2372, has been active since August 2024 and targets a wide range […]<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[701,63,700],"tags":[130],"class_list":["post-1983","post","type-post","status-publish","format-standard","hentry","category-cyber-attack","category-cyber-security-news","category-cyberattack-news","tag-cyber-security-news"],"_links":{"self":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/posts\/1983"}],"collection":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/comments?post=1983"}],"version-history":[{"count":0,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/posts\/1983\/revisions"}],"wp:attachment":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/media?parent=1983"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/categories?post=1983"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/tags?post=1983"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}