Loading story…
Attackers are exploiting Microsoft Entra ID's Device Registration Service after compromising user identities—often through device-code phishing—to enroll attacker-controlled devices in victim tenants. The rogue devices can satisfy Conditional Access requirements, provide persistence, and enable subsequent access to Microsoft 365 data, email exfiltration, and wider tenant activity. Open-source tooling such as ROADtools can support Entra ID reconnaissance and cloud-account abuse, while attackers increasingly vary device metadata to evade detections tied to known tooling artifacts.
Static indicators including the Dsreg/10.0 User-Agent and DESKTOP-XXXXXXXX device names are becoming less reliable as operators use generic, customized, or AI-generated identifiers. Organizations should detect anomalous device registrations behaviorally, correlate device-code phishing activity with new device joins, and compare device names and registration patterns against tenant baselines. MFA for registration, network-based restrictions, and Conditional Access policies requiring compliant devices can reduce this attack path.
See affected versions and whether adversaries are exploiting it.
3 events from the most recent confirmed update back to the earliest known activity.
Attackers were observed moving beyond recognizable ROADrecon artifacts such as the Dsreg/10.0 user agent and DESKTOP-XXXXXXXX device names, including minor naming variations and a device named "Work PC" registered with the MSTokens-PRT/1.0 user agent. This reduced the reliability of static device-name and user-agent detections.
Researchers observed a shared-document-lure phishing page at lockwall.xyz/prime/ presenting a pre-generated Microsoft device code, with activity linked to AWS IP address 3.149.231.11 across multiple victims. The phishing activity enabled a new device registration in a victim Entra ID environment.
Attackers abused Microsoft Entra ID's Device Registration Service to enroll rogue devices under compromised user identities, commonly after device-code phishing. The registrations could satisfy device-based Conditional Access requirements and support Microsoft 365 access, email exfiltration, persistence, or tenant expansion.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers and incident responders are warning that attackers are increasingly abusing Microsoft Entra ID's OAuth 2.0 **device code flow** to hijack Microsoft 365 accounts through legitimate sign-in prompts rather than malware or software exploits. In these attacks, victims are tricked via **vishing** or phishing into entering an attacker-supplied code at Microsoft's device login page and approving MFA, which issues the attacker valid access and refresh tokens. Security firms say the technique can provide broad access to services including **Microsoft Graph**, **Exchange Online**, **OneDrive**, and **SharePoint**, and that password resets alone may not fully contain the intrusion because refresh tokens can persist across services. The activity has been tied to data theft and follow-on abuse. ReliaQuest reported that the **Helix** extortion group used device code phishing, MFA abuse, and rogue authenticator registration to access victim Microsoft 365 tenants, enumerate SharePoint, and exfiltrate data before extortion; reported victims include Medtronic, Nissan, NAIC, Kodak, Infinite Campus, and the University of Nottingham. Separate investigations documented attackers signing in from foreign locations, registering multiple devices, creating hidden inbox rules to suppress replies, and using compromised mailboxes to send phishing messages at scale. Microsoft and security researchers recommend blocking or restricting device code authentication with **Conditional Access**, limiting SharePoint and device registration to managed devices, and monitoring Entra ID telemetry for `AuthenticationProtocol` set to device code, unusual travel, mailbox rule changes, and spikes in device registrations.
Jul 23, 2026
Attackers are abusing the OAuth 2.0 Device Authorization Grant to obtain Microsoft 365 account tokens without stealing passwords. They initiate a legitimate device-code sign-in on an attacker-controlled application or device, then persuade targets through meeting, document-sharing, chat, or security-themed lures to enter the supplied temporary code on a genuine Microsoft sign-in page. Because victims complete the authentication and consent themselves, URL checks and MFA may not stop the attack; the resulting tokens can expose email, files, contacts, and other authorized services. Post-authentication activity can include device registration or Primary Refresh Token issuance, Microsoft Graph queries, mailbox access, and Exchange inbox rules that hide alerts or forward data externally. Defenders should correlate phishing delivery and click telemetry with device-code sign-ins, new-device events, Graph activity, and mailbox-rule changes; contain confirmed incidents by revoking sessions and refresh tokens, disabling unrecognized devices, removing malicious rules, and assessing accessed data. Microsoft recommends blocking device-code flow by default with Entra Conditional Access, first in report-only mode, while maintaining tightly scoped persistent exceptions for legitimate Teams resource accounts and excluding the Device Registration Service where required for enrollment.
Sep 23, 2026
Threat actors are increasingly abusing **OAuth** in *Microsoft Entra ID* and *Microsoft 365* to obtain **access/refresh tokens** that provide durable access even when passwords are reset and MFA is enabled. Reported activity includes both (1) **malicious OAuth app** registrations and deceptive consent prompts that masquerade as legitimate “business integrations,” and (2) abuse of the **OAuth 2.0 Device Authorization Grant** (device code flow) where victims authenticate on Microsoft’s legitimate device login portal, making the intrusion harder to detect with credential-focused controls. Multiple reports describe campaigns targeting business users and organizations (including technology, manufacturing, and financial sectors) to access resources such as **Outlook, Teams, and OneDrive** and to enable mailbox actions and data access under seemingly legitimate application activity. Research and incident reporting highlight that attackers can persist via **service principals** created in victim tenants after consent is granted, and that some integrations may remain effective even if the consenting user is later disabled; separate reporting also describes **device-code vishing/phishing** that leverages legitimate Microsoft OAuth client IDs and standard login workflows to capture tokens without attacker-hosted phishing pages, with one source attributing the vishing activity to **ShinyHunters** (unconfirmed by Microsoft at the time of reporting).
Jun 29, 2026