Microsoft Entra ID Device Code Phishing — OAuth 2.0 Device Authorization Grant Abuse (Storm-2372, EvilTokens, Kali365)
Microsoft Entra ID Device Code Phishing (TL-2026-0943), also tracked as Device Code Phishing, is a high-severity phishing campaign, first published 2026-06-25. It is attributed to Storm-2372 (Russia) with medium confidence, affects Microsoft Entra ID (Azure AD), maps to 17 MITRE ATT&CK techniques (T1087, T1090, T1098), and is covered by 9 detection rules and 26 indicators of compromise.
Key facts for TL-2026-0943
- Threat ID
- TL-2026-0943
- Also known as
- Device Code Phishing, OAuth Device Authorization Grant Abuse
- Severity
- HIGH
- Status
- ACTIVE
- Category
- PHISHING
- First published
- 2026-06-25
- Last reviewed
- 2026-06-25
- Attribution
- Storm-2372
- Attribution confidence
- MEDIUM
- Nation-state nexus
- Russia
- Motivation
- ESPIONAGE
- Target sectors
- government, ngo, defense, telecommunications, healthcare, higher-education, energy, oil-and-gas, it-services, technology, construction, real-estate
- Target regions
- Europe, North America, Africa, Middle East, Australia, New Zealand
- Detection rules
- 9
- Indicators of compromise
- 26
Malware and tooling in Microsoft Entra ID Device Code Phishing
Malware and tooling: EvilTokens, Kali365
Adversaries abuse Microsoft's legitimate OAuth 2.0 device authorization grant flow: they generate device codes with first-party public client IDs (Azure CLI, Microsoft Authentication Broker, Microsoft Office) and use phishing lures to trick users into entering those codes at microsoft.com/devicelogin, harvesting valid access and refresh tokens that bypass MFA. The technique is used by Russian nation-state actor Storm-2372 and by the EvilTokens and Kali365 phishing-as-a-service platforms against Entra ID / Microsoft 365 tenants.
How Microsoft Entra ID Device Code Phishing works
Device code phishing weaponizes the OAuth 2.0 device authorization grant (RFC 8628), a flow designed for input-constrained devices (TVs, IoT, CLI tools). In the legitimate flow a device requests a device_code and a short human-readable user_code from the authorization server, displays the user_code with a verification URL (microsoft.com/devicelogin), and polls the token endpoint until the user approves on a second device; it then receives a scoped, time-limited, revocable access token. Because the flow is a Microsoft first-party, fully legitimate sign-in, it produces no consent prompt and no application warning.
In the attack, the adversary plays the role of the 'device.' The attacker initiates a device_code request against login.microsoftonline.com/oauth2/v2.0/devicecode using a public first-party client ID that requires no app registration or secret — most commonly Azure CLI (04b07795-8ddb-461a-bbee-02f9e1bf7b46), the Microsoft Office client (d3590ed6-52b3-4102-aeff-aad2292ab01c), or, for device-registration abuse, the Microsoft Authentication Broker (29d9ed98-a469-4536-ade2-f981bc1d605e). The attacker wraps the resulting user_code and the genuine microsoft.com/devicelogin URL into a convincing lure (Teams/meeting invite, document-share notice, voicemail, RFQ/bid solicitation, DocuSign, Microsoft Forms) delivered by email or via messaging services (Microsoft Teams, WhatsApp, Signal). When the victim enters the code and authenticates — often silently via existing SSO — the attacker's polling loop instantly receives a valid access_token and refresh_token. Because the tokens are stolen rather than the password, multi-factor authentication is satisfied during the legitimate sign-in and provides no protection.
Storm-2372 (suspected Russian state-aligned, active since August 2024) ran a campaign documented by Microsoft in February 2025, impersonating prominent contacts to build rapport before sending device-code lures, then using the stolen tokens for Microsoft Graph email harvesting (searching mailboxes for keywords such as username, password, admin, teamviewer, anydesk, credentials, secret, ministry, gov). On 14 February 2025 Microsoft documented an evolution: Storm-2372 shifted to the Microsoft Authentication Broker client ID to obtain a refresh token for the device registration service and register attacker-controlled devices in Entra ID, yielding a Primary Refresh Token (PRT) for durable access, while using region-appropriate proxies to blend in. The EvilTokens phishing-as-a-service platform — launched publicly on Telegram on 16 February 2026 with tiered email-delivery, token-capture, and SMTP-relay services and AI-assisted lure customization — ran a large-scale campaign observed from 19 February through mid-March 2026 against 340+ Microsoft 365 organizations across the US, Canada, Australia, New Zealand, and Germany, using Railway.com as the token-harvesting backend behind Cloudflare Workers and Vercel redirect chains. The Kali365 PhaaS platform likewise incorporates device code phishing. Defensive controls center on Conditional Access policies that block the device code flow (including the 'Other clients' / authenticationProtocol = deviceCode condition), phishing-resistant MFA (FIDO2/passkeys), device-registration restrictions, and revocation of refresh tokens via revokeSignInSessions on suspected compromise.
MITRE ATT&CK techniques used in TL-2026-0943
Discovery
T1087 Account Discovery; T1526 Cloud Service Discovery
Command and Control
T1090 Proxy; T1102 Web Service
Persistence
Collection
Credential Access
T1528 Steal Application Access Token; T1556 Modify Authentication Process; T1606 Forge Web Credentials
Lateral Movement
lateral-movement
T1550 Use Alternate Authentication Material
Initial Access
Exfiltration
T1567 Exfiltration Over Web Service
Resource Development
T1583 Acquire Infrastructure; T1587 Develop Capabilities; T1608 Stage Capabilities
Reconnaissance
Affected products and versions in Microsoft Entra ID Device Code Phishing
- Microsoft — Entra ID (Azure AD)
Vulnerable versions: all tenants with device code flow enabled
Fixed in: mitigated via Conditional Access policy blocking device code flow - Microsoft — Microsoft 365
Vulnerable versions: all tenants without device-code-flow Conditional Access controls
Remediation for Microsoft Entra ID Device Code Phishing
Immediate actions
- Create a Conditional Access policy that blocks the OAuth device code authentication flow (authenticationFlows transferMethod = deviceCodeFlow) for all users except a tightly-scoped exception group
- Include 'Other clients' in Conditional Access Client App conditions and require MFA / block for that condition
- Revoke refresh tokens for any suspected-compromised user via the revokeSignInSessions Microsoft Graph API call
- Hunt Entra ID sign-in logs for authenticationProtocol = deviceCode and originalTransferMethod = deviceCodeFlow with ClientAppUsed = 'Other' from unusual locations/ASNs
- Block the known EvilTokens Railway.com polling IPs at the perimeter and review newly registered Entra ID devices
Workarounds
- Adopt Microsoft's managed Conditional Access policy that blocks device code flow (released 2025)
- Scope device code flow to only the specific applications/personas that require it
Longer-term hardening
- Deploy phishing-resistant MFA (FIDO2 security keys, Microsoft Authenticator passkeys) and disable device code flow wherever operationally feasible
- Restrict who may join/register devices in Entra ID (device registration / enrollment limits) and disable device writeback
- Centralize Entra ID sign-in and audit logs in a SIEM and alert on anomalous Graph API mailbox keyword searches
- Enforce sign-in risk and user-risk Conditional Access policies with automated remediation
- Block legacy/basic authentication protocols
Weaknesses (CWE) in Microsoft Entra ID Device Code Phishing
CWE-1390, CWE-287, CWE-1021
Timeline of Microsoft Entra ID Device Code Phishing
- Storm-2372 device code phishing activity assessed by Microsoft to be active since at least August 2024.
- Microsoft Threat Intelligence publishes analysis of Storm-2372's active device code phishing campaign abusing the OAuth device authorization grant.
- Microsoft documents Storm-2372 shifting to the Microsoft Authentication Broker client ID (29d9ed98-a469-4536-ade2-f981bc1d605e) to register attacker-controlled devices and obtain Primary Refresh Tokens.
- Microsoft publishes 'Defending against evolving identity attack techniques,' reinforcing device-code-flow blocking guidance.
- EvilTokens phishing-as-a-service platform launches publicly on Telegram with tiered email-delivery, token-capture, and SMTP-relay services and AI-assisted lure customization.
- EvilTokens large-scale device code phishing campaign begins, observed targeting Microsoft 365 organizations via Railway.com token-harvesting backend.
- Peak EvilTokens activity: campaign targeting 340+ organizations across the US, Canada, Australia, New Zealand, and Germany using Cloudflare Workers and Vercel redirect chains.
- Cloud Security Alliance publishes research note documenting the OAuth device code phishing campaign hitting 340+ Microsoft 365 organizations and the Railway.com infrastructure.
- Huntress publishes 'Tradecraft Tuesday: Device Code Phishing Explained,' summarizing the technique and Storm-2372 / EvilTokens / Kali365 activity.
Sources cited for Microsoft Entra ID Device Code Phishing
- Tradecraft Tuesday: Device Code Phishing Explained
- Storm-2372 conducts device code phishing campaign
- Defending against evolving identity attack techniques
- CSA Research Note: OAuth Device Code Phishing Hits 340+ Microsoft 365 Organizations
- Approved by Design. Abused by Attackers: Inside Device Code Flow Exploitation
- MFA Didn't Fail, the Trust Model Did: Device Code Phishing and OAuth Token Theft (Kali365)
- Detecting device code phishing attacks in Azure: from exploitation to detection
- Entra ID OAuth Phishing via First-Party Microsoft Application
- Go With the Flow: Abusing OAuth Device Code Flow
- Storm-2372 Launches Device Code Phishing Campaign Targeting Microsoft 365 Accounts
Threats related to Microsoft Entra ID Device Code Phishing
- Microsoft 365 Device Code Phishing Campaign Abusing the OAuth 2.0 Device Authorization Grant Flow (EvilTokens PhaaS)
- Device Code Phishing Surge — 37x Increase Driven by EvilTokens and VENOM PhaaS Kits Targeting Microsoft 365
- EvilTokens Phishing-as-a-Service: Microsoft OAuth 2.0 Device Authorization Grant (Device Code) Phishing Against Microsoft 365
- New Phishing Kits 'Jalisco' and 'OmegaLord' Bypass MFA on Microsoft 365 Accounts via OAuth Device Code Abuse and Fake PDF-Reader Credential Harvesting
- Device Code Phishing: OAuth Device Authorization Grant Abuse Bypasses All MFA Forms, Including Passkeys
- Advanced Phishing Tradecraft: ClickFix, Browser-in-the-Browser, OAuth Consent, Device Code, and Fake Video-Conference Lures Bypass MFA and Security Awareness Training
Detection coverage for TL-2026-0943
As of 2026-06-25, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0943 across Splunk SPL, Microsoft KQL and Sigma, covering 26 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.