Loading malware…
1 distinct threat actor Mallory has associated with this family across public reporting. Open in Mallory to see the full evidence chain and overlapping campaigns.
CodeStorm is a previously undocumented Microsoft 365 AiTM phishing kit used to capture credentials, intercept MFA, and obtain authenticated session material.
33 distinct techniques documented for this family, organized by ATT&CK tactic.
Operators used attacker-controlled apex domains and subdomains for lure and harvester infrastructure.
Tencent COS was used to host CodeStorm stage-two JavaScript payloads.
CodeStorm operators used previously compromised Microsoft 365 mailboxes to send phishing emails.
Instead of building fake infrastructure from scratch, attackers are hijacking real M365 accounts and using them as trusted launching pads. This approach lets malicious emails slip past filters that would normally flag suspicious senders.
Operators used compromised Microsoft 365 accounts and stolen authenticated session material to access victim tenants.
The attack begins with a deceptively convincing voicemail notification email. The message mimics a genuine Microsoft communication, complete with a well-formatted layout, a call duration, a reference ID, and an “OPEN VOICEMAIL PORTAL” button branded with the Microsoft logo.
Operators sent credential-harvesting HTML attachments directly to victim inboxes.
Emails contained links pointing directly to attacker-controlled domains hosting CodeStorm credential-harvesting pages.
Lures were delivered through trusted SaaS platforms including SharePoint, Microsoft Sway, allo.io, youengage.me, mixpanel.com, and gamma.app.
CodeStorm executed client-side JavaScript in the victim browser to render the phishing UI and drive credential-harvesting logic.
Victims were required to open lure links or QR-code destinations to reach CodeStorm phishing pages.
Instead of building fake infrastructure from scratch, attackers are hijacking real M365 accounts and using them as trusted launching pads. This approach lets malicious emails slip past filters that would normally flag suspicious senders.
Operators used compromised Microsoft 365 accounts and stolen authenticated session material to access victim tenants.
Operators modified compromised mailboxes by creating or changing inbox rules after successful account access.
Instead of building fake infrastructure from scratch, attackers are hijacking real M365 accounts and using them as trusted launching pads. This approach lets malicious emails slip past filters that would normally flag suspicious senders.
Operators used compromised Microsoft 365 accounts and stolen authenticated session material to access victim tenants.
Operators modified compromised mailboxes by creating or changing inbox rules after successful account access.
CodeStorm used encrypted and obfuscated JavaScript payloads, runtime decoding, string reconstruction, and obfuscated stage-two JavaScript.
Instead of building fake infrastructure from scratch, attackers are hijacking real M365 accounts and using them as trusted launching pads. This approach lets malicious emails slip past filters that would normally flag suspicious senders.
Operators used compromised Microsoft 365 accounts and stolen authenticated session material to access victim tenants.
CodeStorm decoded runtime payloads using LCG/Caesar/XOR logic in one variant and AES-256-CBC with CryptoJS in another.
Once a victim clicks the link, they land on a page protected by a Cloudflare Turnstile challenge that filters out automated scanners. The landing page also probes for browser developer tools and automation signals, and even measures how long a debugger statement takes to execute. If anything suspicious is detected, the page redirects to a legitimate Microsoft URL, appearing completely harmless.
The runtime payload checks for automation and inspection indicators including navigator.webdriver, window.callPhantom, window._phantom, and user-agent strings containing Burp.
Operators consistently created an Outlook inbox rule named LinkedIn that moved messages from the phishing sender into RSS Feeds and marked them read.
CodeStorm reconstructed and executed decoded JavaScript payloads at runtime and dynamically loaded stage-two scripts.
The fake Microsoft 365 login interface captured email addresses, passwords, and MFA artifacts.
On successful replay, the operator obtains authenticated Microsoft 365 session material, including session cookies and tokens issued during the web authentication flow.
CodeStorm proxied Microsoft 365 authentication in real time to intercept credentials, MFA artifacts, and session material.
The kit communicates through a series of actions, do=check for identity discovery, do=login for credential submission, and do=verify to trigger MFA. This design supports the full Microsoft MFA workflow including Authenticator push, SMS one-time codes, voice calls, and Hotmail recovery codes.
ZeroBEC identified and documented how the CodeStorm phishing kit has evolved with a powerful new capability: tenant-aware Microsoft 365 credential replay.
Operators harvested contacts from compromised users' Outlook address books.
Operators used compromised Microsoft 365 context to identify tenant users, contacts, and cloud-account relationships.
Once a victim clicks the link, they land on a page protected by a Cloudflare Turnstile challenge that filters out automated scanners. The landing page also probes for browser developer tools and automation signals, and even measures how long a debugger statement takes to execute. If anything suspicious is detected, the page redirects to a legitimate Microsoft URL, appearing completely harmless.
The runtime payload checks for automation and inspection indicators including navigator.webdriver, window.callPhantom, window._phantom, and user-agent strings containing Burp.
After gaining mailbox access, operators sent phishing messages to other recipients within the same tenant.
Operators reused stolen Microsoft 365 session cookies or tokens after successful MFA.
The fake Microsoft 365 login interface captured email addresses, passwords, and MFA artifacts.
Operators accessed Microsoft 365 mailbox content after compromise.
Follow-on signs of compromise include new inbox rules, unusual OAuth grants, MFA prompts from unfamiliar locations, and successful sign-ins from IPs previously tied to failure events.
Operators conducted keyword-driven reconnaissance against SharePoint (payment, credentials).
Operators accessed SharePoint-hosted cloud content after compromise.
CodeStorm proxied Microsoft 365 authentication in real time to intercept credentials, MFA artifacts, and session material.
CodeStorm used HTTPS web traffic for Tencent COS stage-two payload retrieval and communication with harvester endpoints such as /google.php and /next.php.
Tencent COS / myqcloud.com was used as a web service for hosting stage-two payloads.
308 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.