Loading story…
A new hunting method shows how defenders can detect suspected device code phishing by correlating Entra ID sign-in telemetry with web activity immediately preceding a Device Code authentication. The approach uses the Cmsi:Cmsi endpoint call in sign-in events as the anchor for Device Code logins, then looks back five minutes to identify the last three URLs visited by the same user in DeviceNetworkEvents, helping investigators reconstruct the browsing sequence that led to the authentication.
The technique is designed to surface suspicious behavior without depending on known malicious domains or threat intelligence feeds. It enriches remote IP addresses with country data and filters out expected Microsoft services, common websites, and approved geographies so analysts can focus on unusual browsing patterns that may indicate previously unknown phishing infrastructure rather than treating every Device Code authentication as malicious.
See real exploitation activity before you spend the cycle.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers and incident responders are warning that attackers are increasingly abusing Microsoft Entra ID's OAuth 2.0 **device code flow** to hijack Microsoft 365 accounts through legitimate sign-in prompts rather than malware or software exploits. In these attacks, victims are tricked via **vishing** or phishing into entering an attacker-supplied code at Microsoft's device login page and approving MFA, which issues the attacker valid access and refresh tokens. Security firms say the technique can provide broad access to services including **Microsoft Graph**, **Exchange Online**, **OneDrive**, and **SharePoint**, and that password resets alone may not fully contain the intrusion because refresh tokens can persist across services. The activity has been tied to data theft and follow-on abuse. ReliaQuest reported that the **Helix** extortion group used device code phishing, MFA abuse, and rogue authenticator registration to access victim Microsoft 365 tenants, enumerate SharePoint, and exfiltrate data before extortion; reported victims include Medtronic, Nissan, NAIC, Kodak, Infinite Campus, and the University of Nottingham. Separate investigations documented attackers signing in from foreign locations, registering multiple devices, creating hidden inbox rules to suppress replies, and using compromised mailboxes to send phishing messages at scale. Microsoft and security researchers recommend blocking or restricting device code authentication with **Conditional Access**, limiting SharePoint and device registration to managed devices, and monitoring Entra ID telemetry for `AuthenticationProtocol` set to device code, unusual travel, mailbox rule changes, and spikes in device registrations.
Jul 23, 2026
Huntress reported a sustained 2026 wave of **device code phishing** that used infrastructure from **BL Networks**—also known as **BitLaunch** or `BLNWX`—to target Microsoft 365 users through abused authentication flows. The activity first appeared in Huntress telemetry on April 13, 2026, initially centered on IP `216.203.20[.]95`, then expanded across multiple BL Networks IP ranges and remained active through late July. Researchers said the campaign relied on legitimate-looking hosting and successful device code sign-ins rather than malware delivery, allowing attackers to obtain and abuse user sessions after victims completed the authentication process. The infrastructure overlap is notable because BL Networks has also been examined as an **anonymous VPS** provider attractive to criminal operators, including ransomware actors seeking harder-to-trace hosting. Huntress compared the activity to an earlier Railway-linked wave associated with the **EvilTokens** phishing-as-a-service platform and said the latest operations show continued adaptation rather than a wholly new technique. Defenders were urged to prioritize behavioral detection—such as unusual device code sign-ins, repeated successful logins from suspicious hosting providers, and immediate token or session revocation after suspected compromise—over campaign naming or branding.
Aug 3, 2026
Attackers are abusing the OAuth 2.0 Device Authorization Grant to obtain Microsoft 365 account tokens without stealing passwords. They initiate a legitimate device-code sign-in on an attacker-controlled application or device, then persuade targets through meeting, document-sharing, chat, or security-themed lures to enter the supplied temporary code on a genuine Microsoft sign-in page. Because victims complete the authentication and consent themselves, URL checks and MFA may not stop the attack; the resulting tokens can expose email, files, contacts, and other authorized services. Post-authentication activity can include device registration or Primary Refresh Token issuance, Microsoft Graph queries, mailbox access, and Exchange inbox rules that hide alerts or forward data externally. Defenders should correlate phishing delivery and click telemetry with device-code sign-ins, new-device events, Graph activity, and mailbox-rule changes; contain confirmed incidents by revoking sessions and refresh tokens, disabling unrecognized devices, removing malicious rules, and assessing accessed data. Microsoft recommends blocking device-code flow by default with Entra Conditional Access, first in report-only mode, while maintaining tightly scoped persistent exceptions for legitimate Teams resource accounts and excluding the Device Registration Service where required for enrollment.
Sep 23, 2026