[carlospolop]

Blog URL

https://research.eye.security/device-code-phishing-forensics

Blog Title

Device Code Phishing Forensics: What We Learned Investigating BEC in the Wild

Blog high summary

Documents a scaled device-code phishing BEC technique: an attacker places a short-lived code on a DocuSign/OneDrive-themed page, then the victim enters it on genuine Microsoft and completes MFA, authorizing attacker-controlled M365 access. The real domain, form, and MFA defeat common AitM indicators; tokens can enable Exchange compromise and further token abuse.

Provides browser detections for static pages, SPA fetch/XMLHttpRequest/window.open flows, and EvilTokens AES-GCM loaders; Sentinel KQL for device-code sign-ins and suspicious registrations; and forensics correlating non-interactive logs, linkable token IDs, IP/user-agent, and shared-session UAL activity. Conditional Access must block Device code flow across All resources to prevent Auth Broker bypass and PRT persistence.

PR changes

• src/pentesting-cloud/azure-security/az-privilege-escalation/az-entraid-privesc/az-conditional-access-policies-mfa-bypass.md: Added the DRS-specific device-code policy scope failure mode, prerequisites, and a validation approach, with links to the phishing and PRT pages.
• src/pentesting-cloud/azure-security/az-unauthenticated-enum-and-initial-entry/az-device-code-authentication-phishing.md: Added the observed short code lifetime as a constraint on delayed lures and linked to the Conditional Access scope section.

Errors

mdbook build unavailable

[carlospolop]

Decision: keep

Microsoft documents that authentication-flow policies apply to Device Registration Service only when they target All resources. Microsoft documents a 15-minute default device-code lifetime; the base phishing page listed expires_in but did not explain its effect on delayed lures. The existing PRT page covers the Broker-to-DRS token flow, so the new Conditional Access section links to it rat…

Head: 68f56b1c1f2bef9991a99b81092b7bf40de7208c

[carlospolop]

merge