PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

The rise of device code phishing

bugcrowd.com | blog | #microsoft | #phishing | #red-team | #device-code | #oauth | #mfa-bypass | #token-theft
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Device code phishing tricks victims into entering attacker-generated codes on legitimate login pages, yielding refresh tokens that bypass MFA for long-term access; this piece details the attack chain.
Published
Collected

Related coverage

research · volexity.com
Dangerous Invitations: Russian Threat Actor Spoofs European Security Events in Targeted Phishing Attacks
# Dangerous Invitations: Russian Threat Actor Spoofs European Security Events in Targeted Phishing Attacks December 4, 2025 Matthew Meltzer, Steven Adair, and Tom Lancaster In early 2025, Volexity...
blog · yeswehack.com
‘I’m not the kind of person to rely on tooling’: Sn0rkY shares his Bug Bounty story and top tips
French hacker Sn0rkY shares his Bug Bounty methodology, views on AI tooling and advice for hunters in this YesWeHack interview.
research · netlas.io
Device Code Phishing: Technical Analysis and Proactive Hunting via Netlas
Device-code phishing abuses the OAuth RFC 8628 flow: victims enter codes on genuine Microsoft pages while tokens land with attackers — plus template comparisons and Netlas hunting patterns.
research · labs.cognisys.group
Beyond the Perimeter How an On-Premises Domain Admin Compromise Unlocked the Cloud
Imagine a standard Red Team engagement scenario. Where you somehow manage to compromise a single low-privileged on-premises user. You execute a series of classic post-exploitation manoeuvres: moving laterally, exploiting legacy configurations, and navigating internal network segments. Finally, the “Holy Grail” is achieved, YESS! Domain Admin privileges within the internal Active Directory forest.
research · volexity.com
Phishing for Codes: Russian Threat Actors Target Microsoft 365 OAuth Workflows
# Phishing for Codes: Russian Threat Actors Target Microsoft 365 OAuth Workflows April 22, 2025 Charlie Gardner, Josh Duke, Matthew Meltzer, Sean Koessel, Steven Adair, and Tom Lancaster Since...
research · volexity.com
Multiple Russian Threat Actors Targeting Microsoft Device Code Authentication
# Multiple Russian Threat Actors Targeting Microsoft Device Code Authentication February 13, 2025 Charlie Gardner, Steven Adair, and Tom Lancaster Starting in mid-January 2025, Volexity identified...
Back