Cyb3r

Also known ascyb3r

Cyb3r is a phishing kit associated with Microsoft device code phishing operations targeting Microsoft 365 users. It has been identified as part of a broader phishing-as-a-service ecosystem that operationalizes abuse of Microsoft’s legitimate OAuth device authorization flow to obtain access and refresh tokens. This enables attackers to gain persistent access to victim Microsoft 365 environments without directly stealing passwords, supporting follow-on activity such as reconnaissance, phishing, data theft, and business email compromise. Cyb3r has been observed in campaigns using investment-themed lures and encrypted PDF attachments that conceal links to device code phishing pages. Its tradecraft aligns with mature phishing operations that rely on layered evasion and trusted-service abuse to increase delivery and reduce detection. Cyb3r is one of several active kits seen in the rise of commodity device code phishing, alongside EvilTokens, Kali365, Ghost Hub, and Tycoon2FA. Available information supports classifying Cyb3r as a phishing-enabled cybercriminal capability rather than a nation-state intrusion set. Publicly supported details in this context are limited, and no high-confidence attribution to a specific operator, country of origin, or broader sub-group structure is established here.

Are they targeting you?

Know when an actor pivots toward your sector

Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.

Start free trial

MITRE ATT&CK

Tradecraft

4 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.

5 of 15 tactics7 techniques×N= number of intelligence reports citing this technique

MITRE ATT&CK

TA0001

Initial Access

2 techniques

T1078

Valid Accounts

T1566

Phishing

T1566.001

Spearphishing Attachment

TA0003

Persistence

1 technique

T1078

Valid Accounts

TA0004

Privilege Escalation

1 technique

T1078

Valid Accounts

TA0005

Stealth

1 technique

T1078

Valid Accounts

TA0006

Credential Access

1 technique

T1528

Steal Application Access Token

ACTIVITY FEED

Recent activity

1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

1 SOURCESView more in app

levelblueNews

Jun 9, 2026

The Device Code Phishing Tsunami: What We’re Seeing in the Wild

Active phishing kit used in device code phishing campaigns, including funding-themed lures delivered via encrypted PDFs from compromised accounts.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: sector and geo overlap with your footprint, the IOCs they’re burning right now, detection coverage, and what to do next.

Start free trial

Target overlap

Match sector + geo + tech-stack targeting against your real footprint.

Tradecraft mapping4

Every observed MITRE ATT&CK technique, grouped by tactic.

Malware arsenal

Families this actor is known to deploy, with IOCs and behavior.

Exploited CVEs

CVEs this actor has used in known campaigns.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

Observables

Domains, IPs, and hashes tied to this actor, refreshed continuously.

Cyb3r

Also known ascyb3r