17 matches found
TokenTacticsV2
root@kitploit: / / / / / / / / | \ / / / / /// / \ / / / / / / / / | | / / / / / / / // / , / / / / / / // // / // // / / | |/ / / / // //||// // /,////// |/ TokenTactics v2 이것은 원래 Stephan Borosh @rvrsh3ll와 Bobby Cooke @0xBoku가 작성한 TokenTactics의 업데이트된 버전입니다. Azure JSON Web Token"JWT" 조작 도구...
EasyTokens
EasyTokens 적대자 모의 훈련을 위한 디바이스 코드 피싱 서버입니다. 디바이스 권한 부여 흐름을 통해 Microsoft 365 OAuth 토큰을 캡처합니다. GraphSpy에서 영감을 받았습니다. 경고 — 승인된 사용만 가능합니다. 이 도구는 명시적인 서면 승인을 받은 침투 테스터 및 레드 팀 운영자를 대상으로 합니다. 오용 시 컴퓨터 사기 관련 법률을 위반할 수 있습니다. 작동 방식 1. 운영자가 운영자 UI를 통해 디바이스 코드 캠페인 을 생성합니다. 2. 피해자용 등록 페이지Dunder Mifflin 테마는 사용자...
TokenTactics
TokenTactics Azure JSON Web Token（"JWT"）操作ツールセット Azureアクセストークンを使用すると、デバイスコードでサインインしたユーザーとして特定のエンドポイントに認証できます。多要素認証を使用していた場合でも同様です。ユーザーのアクセストークンを入手できれば、Outlook、SharePoint、OneDrive、MSTeamsなどのアプリにアクセスできる可能性があります。 たとえば、GraphまたはMSGraphトークンを保有していれば、Azureに接続してユーザーやグループなどをダンプできます。その後、条件付きアクセスポリシーに応じて、Azu...
Kali365 Weaponizes Microsoft Authentication Against US Companies: New Enterprise Risk
Kali365 is turning a legitimate Microsoft login into a gateway to corporate data. The phishing kit targets US organizations with attacker-controlled device codes that victims approve on Microsoft's real authentication page. Once access and refresh tokens are issued, attackers may retain access to...
Greatness PhaaS Adds Device Code Phishing to Bypass MFA and Steal Tokens
The commercial phishing-as-a-service PhaaS toolkit known as Greatness has become the latest crimeware solution to add support for device code phishing, a rapidly growing cyber threat that abuses the legitimate OAuth 2.0 Device Authorization Grant to bypass Multi-Factor Authentication MFA and seiz...
6 Reasons Why Device Code Phishing is the Fastest-Growing Threat of 2026
Device code phishing - the abuse of the OAuth 2.0 device authorization grant to steal access tokens - has evolved from a niche red-team technique to an industrial-scale threat in under six months. Designed for input-constrained devices like smart TVs, printers, and so on, the device authorization...
Forg365 PhaaS Targets Microsoft 365 with Device Code and AitM Session Theft
A new phishing-as-a-service PhaaS operation called Forg365 is using a combination of device code phishing, adversary-in-the-middle AitM tactics, antibot evasion, artificial intelligence AI-assisted lure creation, and post-compromise mailbox operations targeting Microsoft 365 accounts. Distributed...
When checking the URL isn’t enough: a Device Code Phishing attack via a Microsoft website
One of the most common pieces of anti-phishing advice is to double-check the website's domain name before providing your credentials. Typically, a fraudulent domain stands out to the trained eye, differing from the official URL by at least a few characters. Recently, however, we encountered a...
CalPhishing Scam Uses EvilTokens Kit, Outlook Invites to Steal M365 Sessions
Hackers are exploiting Outlook calendar invites and device code phishing to steal M365 session tokens, bypass MFA and breach enterprise accounts...
Inside an AI‑enabled device code phishing campaign
In this article 1. Attack chain overview 2. Mitigation and protection guidance 3. Indicators of compromise IOC 4. References 5. Learn more Microsoft Defender Security Research has observed a widespread phishing campaign leveraging the Device Code Authentication flow to compromise organizational...
Device Code Phishing Hits 340+ Microsoft 365 Orgs Across Five Countries via OAuth Abuse
Cybersecurity researchers are calling attention to an active device code phishing campaign that's targeting Microsoft 365 identities across more than 340 organizations in the U.S., Canada, Australia, New Zealand, and Germany. The activity, per Huntress, was first spotted on February 19, 2026, wit...
Russia-Linked Hackers Use Microsoft 365 Device Code Phishing for Account Takeovers
A suspected Russia-aligned group has been attributed to a phishing campaign that employs device code authentication workflows to steal victims' Microsoft 365 credentials and conduct account takeover attacks. The activity, ongoing since September 2025, is being tracked by Proofpoint under the...
Russia’s Storm-2372 Hits Orgs with MFA Bypass via Device Code Phishing
Russian APT group Storm-2372 employs device code phishing to bypass Multi-Factor Authentication MFA. Targets include government, technology, finance,…...
Device Code Phishing
This isn't new, but it's increasingly popular: The technique is known as device code phishing. It exploits "device code flow," a form of authentication formalized in the industry-wide OAuth standard. Authentication through device code flow is designed for logging printers, smart TVs, and similar...
⚡ THN Weekly Recap: Google Secrets Stolen, Windows Hack, New Crypto Scams and More
Welcome to this week's Cybersecurity News Recap. Discover how cyber attackers are using clever tricks like fake codes and sneaky emails to gain access to sensitive data. We cover everything from device code phishing to cloud exploits, breaking down the technical details into simple, easy-to-follo...
Microsoft: Russian-Linked Hackers Using 'Device Code Phishing' to Hijack Accounts
Microsoft is calling attention to an emerging threat cluster it calls Storm-2372 that has been attributed to a new set of cyber attacks aimed at a variety of sectors since August 2024. The attacks have targeted government, non-governmental organizations NGOs, information technology IT services an...
