Activity timeline
T1098.005 first appeared in tracked threats on and was most recently reported on . The busiest month was 2026-07 with 9 reports, and 28 of the 28 threats were reported in the twelve months to 2026-10.
How adversaries use it
T1098.005 Device Registration is catalogued by MITRE ATT&CK under the Persistence and Privilege Escalation tactics in the Enterprise matrix, as a sub-technique of T1098 Account Manipulation. Threadlinqs maps 28 of 2623 tracked threats (1.1%) to it; by severity that is 2 critical, 23 high, 3 medium.
Threats that use T1098.005 most often also use T1566.002 Spearphishing Link (21 threats), T1528 Steal Application Access Token (20 threats), T1550.001 Application Access Token (19 threats), T1078.004 Cloud Accounts (16 threats), T1204.001 Malicious Link (14 threats). These are the techniques an intrusion set tends to chain with it, so they are the natural next places to look when it is observed.
19 tracked threat actors appear in the threats that use T1098.005; the most frequent are Greatness PhaaS Operators (3), Kali365 PhaaS operators (2), ShinyHunters (2), Storm-2992 (2), APT29 (1).
Mitigations
MITRE ATT&CK lists 1 mitigation for T1098.005.
Data sources
Telemetry that can reveal T1098.005, per MITRE ATT&CK.
- Active Directory — Active Directory Object Creation
- Application Log — Application Log Content
- User Account — User Account Modification
Threat actors using it
Tracked threats
28 tracked threats use T1098.005.
- EvilTokens (Storm-2992): AI-Chatbot Device-Code Phishing Service Disrupted by Microsoft DCU, Plus AI-Enabled…high
- AI-Enabled Social Engineering and Synthetic Media (Deepfakes) Undermining Identity Verificationhigh
- Google Account Security Team Impersonation Vishing Campaign — Telegram Recruitment Ad Leaks Call Scriptmedium
- Microsoft-Led Coalition Takes Down EvilTokens AI-Powered Phishing-as-a-Service Platform (Storm-2992)high
- N0va Phishkit Uses Device Code Phishing to Bypass MFA and Hijack SSO Sessions Across US and EUhigh
- Advanced Phishing Tradecraft: ClickFix, Browser-in-the-Browser, OAuth Consent, Device Code, and Fake…medium
- Russian APT29-linked clusters (UNC6293, UNC7005) and UNC5976 — OAuth phishing, device-code phishing, and…high
- Malware Abuses Windows Hello for Business Key to Authenticate to Microsoft Entra IDhigh
- Unit 42: Identity Compromise Is the Primary Attack Vector in Nearly 90% of Incidentshigh
- UNC6671 Automates Microsoft 365 Data Theft via Vishing-Driven AiTM Phishing and Session Hijackinghigh
- QuoIntelligence Weekly Snapshot W32 2026: DOUBLECUP ClickFix loader, UTA0533 SonicWall SMA1000 zero-day…high
- Greatness PhaaS Adds Device Code Phishing to Bypass MFA and Steal OAuth Tokenshigh
- Greatness PhaaS Platform Spoofs RingCentral in Adversary-in-the-Middle and Device Code Phishing Campaign…high
- Pass-ta-key: Novel Attack Surface in Google Password Manager Synced Passkey Authenticationcritical
- Russian FSB/GRU Actors (UNC5792, UNC4221) Phish Signal Backup Recovery Keys for Persistent Account Takeoverhigh
- Check Point Q2 2026 Brand Phishing Report: Microsoft Leads at 23%, ChatGPT Enters Top 10 Impersonated Brandsmedium
- Instructure Canvas Breach (ShinyHunters) Drives 58% of H1 2026 Data Breach Notices — 275M Records, 8,809…critical
- Kali365 Phishing-as-a-Service Kit Abuses Microsoft Device Code Authentication to Hijack Microsoft 365 Accountshigh
- Device Code Phishing Campaign Targets Microsoft 365 via OAuth Device Authorization Grant Abusehigh
- Misconfigured Server Exposes Three Evilginx-Based Microsoft 365 Phishing Operations (codemado, mail-argenta…high
- O-UNC-066 ("Pink") Abuses Microsoft Entra Passkey Enrollment via Live-Operator Phone Phishing to Hijack…high
- ARToken Phishing Panel Abuses Microsoft OAuth Device Code Flow to Hijack Microsoft 365 Accounts (EvilTokens…high
- ARToken: Business Email Compromise-as-a-Service Platform Targeting Microsoft 365 (Cisco Talos / EvilTokens…high
- EvilTokens Phishing-as-a-Service: Microsoft OAuth 2.0 Device Authorization Grant (Device Code) Phishing…high
- Dashlane Device-Registration API 2FA OTP Brute-Force Campaign — Encrypted Vaults of <20 Personal-Plan…high
- VaultJacking — Google Password Manager Vault Theft via Single Captured 6-Digit PIN (PhishU Framework)high
- Kali365 PhaaS — Telegram-Distributed Microsoft 365 Device-Code Phishing with OAuth Token Theft & MFA Bypass…high
- State-Sponsored Signal Messenger Hijacking — QR Code Phishing Abusing Linked Devices, WAVESIGN Database…high
Detection coverage
Threadlinqs maintains 106 detection rules mapped to T1098.005 (SPL 36, KQL 35, Sigma 35). Rule content is available to Blue tier accounts and above; this page shows counts only.
Parent technique
T1098 Account Manipulation — 288 tracked threats at the technique level.