{
  "Event": {
    "analysis": "1",
    "date": "2026-07-22",
    "extends_uuid": "",
    "info": "[Threat Intel] Device Code Phishing: Turning a Convenience Feature Into an MFA Bypass",
    "protected": false,
    "publish_timestamp": "1785586398",
    "published": true,
    "threat_level_id": "3",
    "timestamp": "1785586398",
    "uuid": "d2453ca5-cc74-490d-a30c-9b39a54a2f34",
    "Orgc": {
      "name": "Rectifyq",
      "uuid": "cd9bd516-61fa-476b-980f-2f8de03992d4"
    },
    "Tag": [
      {
        "colour": "#717bc3",
        "local": false,
        "name": "misp-galaxy:producer=\"Trend Micro\"",
        "relationship_type": ""
      },
      {
        "colour": "#ffffff",
        "local": false,
        "name": "tlp:clear",
        "relationship_type": ""
      },
      {
        "colour": "#004646",
        "local": false,
        "name": "type:OSINT",
        "relationship_type": ""
      },
      {
        "colour": "#b94b1d",
        "local": false,
        "name": "rectifyq:mitre-att&ck=\"from-original-src\"",
        "relationship_type": ""
      },
      {
        "colour": "#b94b1d",
        "local": false,
        "name": "rectifyq:mitre-att&ck=\"from-OTX\"",
        "relationship_type": ""
      },
      {
        "colour": "#49a260",
        "local": false,
        "name": "rectifyq:category=\"threat\"",
        "relationship_type": ""
      },
      {
        "colour": "#130049",
        "local": false,
        "name": "rectifyq:sub-category=\"campaign-analysis\"",
        "relationship_type": ""
      },
      {
        "colour": "#150050",
        "local": false,
        "name": "rectifyq:sub-category=\"report\"",
        "relationship_type": ""
      },
      {
        "colour": "#ffd12e",
        "local": false,
        "name": "rectifyq:target=\"broad-based\"",
        "relationship_type": ""
      },
      {
        "colour": "#55acee",
        "local": false,
        "name": "rectifyq:MY-relevancy=\"potentially-relevant\"",
        "relationship_type": ""
      },
      {
        "colour": "#3d38fc",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Acquire Infrastructure - T1583\"",
        "relationship_type": ""
      },
      {
        "colour": "#454726",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Compromise Infrastructure - T1584\"",
        "relationship_type": ""
      },
      {
        "colour": "#c202a1",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Spearphishing Link - T1566.002\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Multi-Factor Authentication Request Generation - T1621\"",
        "relationship_type": ""
      },
      {
        "colour": "#08221e",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Steal Application Access Token - T1528\"",
        "relationship_type": ""
      },
      {
        "colour": "#5300bd",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Application Access Token - T1550.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Device Registration - T1098.005\"",
        "relationship_type": ""
      },
      {
        "colour": "#71ecdb",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Account Manipulation - T1098\"",
        "relationship_type": ""
      },
      {
        "colour": "#77a4ec",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Email Collection - T1114\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Impersonation - T1656\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Email Hiding Rules - T1564.008\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Multi-Factor Authentication - T1556.006\"",
        "relationship_type": ""
      },
      {
        "colour": "#626567",
        "local": false,
        "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
        "relationship_type": ""
      },
      {
        "colour": "#626567",
        "local": false,
        "name": "rectifyq:no-samples-in=\"Tria.ge\"",
        "relationship_type": ""
      },
      {
        "colour": "#3800d9",
        "local": false,
        "name": "rectifyq:action-taken=\"VT-comment\"",
        "relationship_type": ""
      },
      {
        "colour": "#3d00e9",
        "local": false,
        "name": "rectifyq:action-taken=\"telegram\"",
        "relationship_type": ""
      }
    ],
    "Attribute": [
      {
        "category": "External analysis",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784862044",
        "to_ids": false,
        "type": "link",
        "uuid": "ba2e1889-5727-4fc6-b743-27e4a0adb155",
        "value": "https://www.trendmicro.com/en_us/research/26/g/device-code-phishing.html"
      },
      {
        "category": "Other",
        "comment": "Description",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784862044",
        "to_ids": false,
        "type": "text",
        "uuid": "a672ab13-28bd-4af6-83a9-2bc2df1ed974",
        "value": "Device code phishing exploits the OAuth 2.0 device authorization grant, a legitimate authentication feature designed for input-limited devices like smart TVs. Attackers initiate a device-code request with Microsoft, receive a valid code, then trick victims into approving it through social engineering. The victim authenticates on genuine Microsoft pages and completes MFA, but the session tokens are issued to the attacker instead. When targeting the Microsoft Authentication Broker, attackers can register rogue devices and obtain long-lived refresh tokens for persistent access. A recent campaign used sophisticated multi-stage delivery chains involving Google Sites, compromised website redirectors, and fake document-sharing portals. After successful authentication, attackers registered multiple devices, created hidden mailbox rules, and used compromised accounts to send additional phishing emails, all without touching victim endpoints."
      },
      {
        "category": "Other",
        "comment": "Summary",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784862044",
        "to_ids": false,
        "type": "text",
        "uuid": "3451a43a-d6d8-4203-aa5c-93de23bd4fc5",
        "value": "Name: Device Code Phishing: Turning a Convenience Feature Into an MFA Bypass\nAuthor: AlienVault\nAdversary: \nTags: [\"microsoft 365 compromise\", \"spearphishing\", \"authentication broker\", \"oauth 2.0 abuse\", \"email account takeover\", \"session hijacking\", \"mfa bypass\", \"device code phishing\"]\nTgtd countries: []\nMlwr families: []\nAttack_ids: []\nIndustries: []"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785580229",
        "to_ids": true,
        "type": "hostname",
        "uuid": "3dbc40f1-5a52-4986-8989-29b3ebd8529e",
        "value": "html.phish.microsoft",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "Sender/impersonation domains",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785580251",
        "to_ids": true,
        "type": "domain",
        "uuid": "90663e93-ad84-4ff8-a9eb-60e13ff92e6b",
        "value": "cholaw-kr.co",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "Sender/impersonation domains",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785580272",
        "to_ids": true,
        "type": "domain",
        "uuid": "c215db4a-4068-4b67-8523-531343e46903",
        "value": "rlcounsel.com",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "Phishing endpoint",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785580293",
        "to_ids": true,
        "type": "hostname",
        "uuid": "447fb0ed-0250-4dd6-9dde-6f17db6edda5",
        "value": "up88qope1z.hlpadditives.com",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "Phishing endpoint",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785580314",
        "to_ids": true,
        "type": "hostname",
        "uuid": "a8873dba-688d-4dfd-a756-6ededd166c5d",
        "value": "zr6dgshpvf.flosli.com",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "Open redirectors (compromised)",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785580335",
        "to_ids": true,
        "type": "domain",
        "uuid": "50faed1c-fc30-404a-88ab-e6f8ba2dfca0",
        "value": "eusei.com",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785580356",
        "to_ids": true,
        "type": "domain",
        "uuid": "407b08cd-1988-44c0-a78a-424bda865863",
        "value": "zrdesignlabo.com",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "Phishing endpoint",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785580377",
        "to_ids": true,
        "type": "hostname",
        "uuid": "53cd4f55-954d-4f7e-ab67-f0e7268e5a54",
        "value": "profileupdate-collaboration.stefan-dufva.workers.dev",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "Attacker IP address",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785580398",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "ca49994c-33ec-4d43-ab1d-2384eddff967",
        "value": "104.219.238.253",
        "Tag": [
          {
            "colour": "#9a9ff8",
            "local": false,
            "name": "asn:asn=\"27176\"",
            "relationship_type": ""
          },
          {
            "colour": "#d51cea",
            "local": false,
            "name": "asn:as-owner=\"DATAWAGON\"",
            "relationship_type": ""
          },
          {
            "colour": "#d16c37",
            "local": false,
            "name": "asn:as-country=\"US\"",
            "relationship_type": ""
          },
          {
            "colour": "#0088cc",
            "local": false,
            "name": "misp-galaxy:country=\"united states of america\"",
            "relationship_type": ""
          },
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "Attacker IP address",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785580419",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "222262ae-8955-4c1a-b310-5262589b51a0",
        "value": "43.165.1.42",
        "Tag": [
          {
            "colour": "#dd7331",
            "local": false,
            "name": "asn:asn=\"132203\"",
            "relationship_type": ""
          },
          {
            "colour": "#723dcd",
            "local": false,
            "name": "asn:as-owner=\"TENCENT-NET-AP-CN Tencent Building, Kejizhongyi Avenue\"",
            "relationship_type": ""
          },
          {
            "colour": "#9256df",
            "local": false,
            "name": "asn:as-country=\"CN\"",
            "relationship_type": ""
          },
          {
            "colour": "#0088cc",
            "local": false,
            "name": "misp-galaxy:country=\"china\"",
            "relationship_type": ""
          },
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "Attacker IP address",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785580441",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "05fda192-f896-4e06-acc2-1501b05b72f5",
        "value": "40.124.130.50",
        "Tag": [
          {
            "colour": "#4d7cde",
            "local": false,
            "name": "asn:asn=\"8075\"",
            "relationship_type": ""
          },
          {
            "colour": "#61ef58",
            "local": false,
            "name": "asn:as-owner=\"MICROSOFT-CORP-MSN-AS-BLOCK\"",
            "relationship_type": ""
          },
          {
            "colour": "#d16c37",
            "local": false,
            "name": "asn:as-country=\"US\"",
            "relationship_type": ""
          },
          {
            "colour": "#0088cc",
            "local": false,
            "name": "misp-galaxy:country=\"united states of america\"",
            "relationship_type": ""
          },
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "Attacker IP address",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785580462",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "fbda3a14-8ce0-4c7c-a127-f232c6c591dc",
        "value": "18.118.111.82",
        "Tag": [
          {
            "colour": "#4745f2",
            "local": false,
            "name": "asn:asn=\"16509\"",
            "relationship_type": ""
          },
          {
            "colour": "#5424ef",
            "local": false,
            "name": "asn:as-owner=\"AMAZON-02\"",
            "relationship_type": ""
          },
          {
            "colour": "#d16c37",
            "local": false,
            "name": "asn:as-country=\"US\"",
            "relationship_type": ""
          },
          {
            "colour": "#0088cc",
            "local": false,
            "name": "misp-galaxy:country=\"united states of america\"",
            "relationship_type": ""
          },
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "Attacker IP address",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785580483",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "b89de926-9712-4ba3-b88a-da5d00d172f7",
        "value": "83.136.210.246",
        "Tag": [
          {
            "colour": "#a7093b",
            "local": false,
            "name": "asn:asn=\"400897\"",
            "relationship_type": ""
          },
          {
            "colour": "#c008f8",
            "local": false,
            "name": "asn:as-owner=\"PETROSKY\"",
            "relationship_type": ""
          },
          {
            "colour": "#d16c37",
            "local": false,
            "name": "asn:as-country=\"US\"",
            "relationship_type": ""
          },
          {
            "colour": "#0088cc",
            "local": false,
            "name": "misp-galaxy:country=\"united states of america\"",
            "relationship_type": ""
          },
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "Open redirectors (compromised)",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785580504",
        "to_ids": true,
        "type": "domain",
        "uuid": "931e3b44-1ee9-488a-a9de-07345e604f06",
        "value": "cineuropa.org",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      }
    ]
  }
}