Threat reportPhishingTL-2026-3981
Device Code Authentication Phishing Abusing Microsoft Sign-In via Fake Mimecast Device Enrollment
Device Code Authentication Phishing Abusing Microsoft (TL-2026-3981) is a high-severity phishing campaign, first published 2026-10-20. It has no confirmed attribution, affects Microsoft Microsoft Entra ID / Microsoft 365 (OAuth 2.0 device, maps to 9 MITRE ATT&CK techniques (T1078.004, T1098.005, T1111), and is covered by 9 detection rules and 12 indicators of compromise.
- Severity
- HIGHAssessed severity
- CVEs
- 0None referenced
- Techniques
- 9MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 12Indicators of compromise
Key facts for TL-2026-3981
- Threat ID
- TL-2026-3981
- Severity
- HIGH
- Status
- ACTIVE
- Category
- PHISHING
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Target sectors
- business, management and executives
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 12
Malware and tooling in Device Code Authentication Phishing Abusing Microsoft
Malware and tooling: EvilTokens
How Device Code Authentication Phishing Abusing Microsoft works
Cofense Phishing Defense Center describes phishing emails (e.g., fake bidding invitations) that lead victims to spoofed Syncfusion/Microsoft login pages and a fake Mimecast device enrollment page displaying an access code. The victim enters the code in a legitimate Microsoft authentication dialog, granting the attacker's application access to the account without the password and potentially bypassing MFA.
Cofense's Phishing Defense Center (published 2026-10-20) documents a multi-stage device code phishing campaign. The lure is an ordinary-looking business email, such as a bidding invitation, with a subject line designed to capture interest. The link leads to a spoofed login page branded with Syncfusion and Microsoft that collects the victim's email address. The victim is then shown a spoofed Mimecast device enrollment page presented as an 'IT policy' step, which displays a temporary access code. The victim is told to enter that code into a Microsoft authentication window. Because that window is the legitimate Microsoft device code dialog, entering the code authorizes the originating (attacker-controlled) application to access the account without requiring the user's password, and may bypass MFA. Cofense notes the URL in the address bar does not match any of the three brands' registered domains. Targets are decision-makers, management-level personnel and key figures, though anyone is exposed.
The technique abuses the OAuth 2.0 Device Authorization Grant (RFC 8628). The attacker's application requests a device code and user code, the victim completes sign-in and MFA on genuine Microsoft infrastructure, and the attacker's polling loop receives access and refresh tokens. Microsoft's reporting on Storm-2372 (Russia-aligned, moderate confidence; reclassified in a July 2026 update as an initial-access sub-cluster of Midnight Blizzard) shows the same technique used for follow-on Graph API email harvesting and device registration through the Microsoft Authentication Broker client ID to obtain Primary Refresh Tokens. The Cloud Security Alliance reported a separate financially motivated wave, the EvilTokens PhaaS (launched 2026-02-16, 340+ Microsoft 365 organizations), with construction-bid lures similar to this campaign. No source ties the Cofense campaign to Storm-2372, TA2723 or EvilTokens, and the article names no actor, kit, domains or IPs. Attribution is therefore Unknown.
Remediation per Cofense: change the password, sign out and revoke active sessions, review account activity, remove unfamiliar authorized applications, re-verify security and MFA methods, and check for unauthorized forwarding rules or recovery address changes. Microsoft recommends blocking device code flow with a Conditional Access 'Authentication flows' policy wherever possible, and allowing it only for documented, secured use cases.
MITRE ATT&CK techniques used in TL-2026-3981
Initial Access
T1078.004 Cloud Accounts; T1566.002 Spearphishing Link
Persistence
Credential Access
T1111 Multi-Factor Authentication Interception; T1528 Steal Application Access Token
Collection
T1114.002 Remote Email Collection
Execution
lateral-movement
T1550.001 Application Access Token
Defense Evasion
Affected products and versions in Device Code Authentication Phishing Abusing Microsoft
- Microsoft — Microsoft Entra ID / Microsoft 365 (OAuth 2.0 device authorization grant)
Vulnerable versions: Tenants permitting device code flow
Remediation for Device Code Authentication Phishing Abusing Microsoft
Immediate actions
- Change the password of any account that entered a device code and revoke active sessions and refresh tokens (revokeSignInSessions)
- Review account activity and remove unfamiliar authorized applications
- Check for unauthorized mailbox forwarding rules and changed recovery addresses
- Re-verify security and MFA methods
- Query Entra sign-in logs for authenticationProtocol deviceCode and audit device registrations following suspicious sign-ins
Workarounds
- Create a Conditional Access policy (Conditions > Authentication flows > Device code flow, Grant: Block access), starting in Report-only mode
- Exclude only break-glass accounts and documented legacy tooling
- Verify that the address-bar domain matches the brand's registered domain before entering anything
Longer-term hardening
- Treat device code flow as a deprecated authentication mechanism and audit legitimate dependencies
- Require admin consent for OAuth application registrations
- Require device compliance or Hybrid Azure AD join for access
- Train users that an enrollment or access code must never be entered into a Microsoft sign-in window from an unsolicited page
Timeline of Device Code Authentication Phishing Abusing Microsoft
- Storm-2372 begins device code phishing against Microsoft 365 (Microsoft: active since August 2024; month-level date)
- Microsoft publishes 'Storm-2372 conducts device code phishing campaign' and recommends blocking device code flow
- Microsoft updates its blog: Storm-2372 shifts to the Microsoft Authentication Broker client ID to obtain refresh tokens for device registration and PRTs
- EvilTokens device code PhaaS launches on Telegram (CSA)
- Microsoft Learn guidance on blocking device code flow with Conditional Access updated
- CSA reports EvilTokens-linked device code phishing reached 340+ Microsoft 365 organizations, including construction-bid lures
- Microsoft updates its Storm-2372 blog, assessing it as an initial-access sub-cluster of Midnight Blizzard
- Cofense PDC publishes a campaign using fake bidding invitations, spoofed Syncfusion/Microsoft login pages and a fake Mimecast device enrollment page to harvest device code authorization
Sources cited for Device Code Authentication Phishing Abusing Microsoft
- Beyond Passwords: How Attackers Abuse Device Code Authentication
- Storm-2372 conducts device code phishing campaign
- Block authentication flows with Conditional Access policy
- CSA Research Note: OAuth Device Code Phishing Hits 340+ Microsoft 365 Organizations
- Threat researchers spot 'device code' phishing attacks targeting Microsoft accounts
- Phishing campaign targets Microsoft device code authentication flows
- Storm-2372: Russia-Linked Hackers Exploit Microsoft 365 Device Code Phishing
Detection coverage for TL-2026-3981
As of 2026-10-20, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-3981 across Splunk SPL, Microsoft KQL and Sigma, covering 12 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.