Threat reportPhishingTL-2026-5428
Device Code Phishing: Turning a Convenience Feature Into an MFA Bypass (Microsoft 365/Entra ID)
Trend Micro documents device-code phishing against Microsoft 365/Entra ID users: the victim is lured to enter an attacker-initiated device code on the genuine Microsoft sign-in page and completes MFA, so Microsoft issues tokens to the attacker. The attacker then registers devices and creates mailbox rules for persistent access. First disclosed .
Key facts
| Identifiers | TL-2026-5428 |
|---|---|
| Severity | HIGH |
| First disclosed | |
| Affected products | Microsoft Microsoft 365 / Microsoft Entra ID (OAuth device code flow) |
| Malware | HTML.Phish.Microsoft |
| MITRE ATT&CK techniques | T1098.005 Device Registration, T1114 Email Collection, T1528 Steal Application Access Token, T1550.001 Application Access Token, T1556.006 Multi-Factor Authentication, T1564.008 Email Hiding Rules, T1566.002 Spearphishing Link, T1583 Acquire Infrastructure, T1584 Compromise Infrastructure, T1621 Multi-Factor Authentication Request Generation, T1684.001 Impersonation |
| Motivation | UNKNOWN |
| Target sectors | legal, professional-services, enterprise-microsoft-365 |
| Detection rules | 9 (1 shown free) |
| Sources | 8 cited sources |
Detection coverage
As of 2026-11-06, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5428 across Splunk SPL, Microsoft KQL and Sigma, covering 19 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.
Free detection: Entra ID Successful Device Code Flow Sign-In (Device Code Phishing)
TL-2026-5428: fires on a successful Microsoft Entra ID sign-in using the OAuth device authorization grant (authenticationProtocol=deviceCode). In the device-code phishing campaign documented by Trend Micro the victim approves an attacker-initiated code on the genuine Microsoft page and MFA is satisfied, so the attacker's polling client receives access and refresh tokens (T1528, T1550.001, T1621). Device-code sign-ins are rare in most tenants, so any success is worth triage.
- Languages: Splunk SPL, Microsoft KQL, Sigma
- ATT&CK: T1528, T1550.001, T1621
- Data sources: azure:monitor:aad (Entra sign-in logs), SigninLogs, AADNonInteractiveUserSignInLogs, azure_signinlogs
- Severity: high
- Confidence: high
Splunk SPL
index=azure sourcetype="azure:monitor:aad" (category="SignInLogs" OR category="NonInteractiveUserSignInLogs") properties.authenticationProtocol=deviceCode properties.status.errorCode=0
| eval user='properties.userPrincipalName', src_ip='properties.ipAddress', app='properties.appDisplayName', country='properties.location'
| stats count min(_time) as first_seen max(_time) as last_seen values(app) as apps values(src_ip) as src_ips values(country) as countries by user
| convert ctime(first_seen) ctime(last_seen)Microsoft KQL
union isfuzzy=true SigninLogs, AADNonInteractiveUserSignInLogs
| where TimeGenerated > ago(24h)
| where ResultType == 0
| where AuthenticationProtocol =~ "deviceCode" or OriginalTransferMethod =~ "deviceCodeFlow"
| summarize Events = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated), Apps = make_set(AppDisplayName), IPs = make_set(IPAddress) by UserPrincipalNameSigma
title: Entra ID Successful Device Code Flow Sign-In
id: 5b0e6a1c-3d52-4c8e-9a41-7f2d1e8b5c01
status: experimental
description: Detects successful Microsoft Entra ID sign-ins using the OAuth device code flow, abused in device-code phishing to obtain tokens after the victim completes MFA on the genuine Microsoft page.
references:
- https://www.trendmicro.com/en_us/research/26/g/device-code-phishing.html
- https://www.microsoft.com/en-us/security/blog/2025/02/13/storm-2372-conducts-device-code-phishing-campaign/
author: Threadlinqs Team
date: 2026/11/06
tags:
- attack.credential-access
- attack.t1528
- attack.t1621
- attack.lateral-movement
- attack.t1550.001
logsource:
product: azure
service: signinlogs
detection:
selection:
AuthenticationProtocol: deviceCode
ResultType: 0
condition: selection
falsepositives:
- Legitimate device-code sign-ins from Azure CLI, PowerShell or input-constrained devices (TVs, IoT, Teams Rooms)
- Developers using az login --use-device-code
level: high
Known false positives:
- Azure CLI / PowerShell device-code logins by administrators and developers
- Teams Rooms, kiosks and IoT devices that legitimately use device code
Tuning notes: Exclude known service accounts, device UPNs and corporate egress IPs via a lookup. Confirm the authenticationProtocol field name in your ingest (diagnostic-settings vs Graph export). Enforce a Conditional Access authentication-flows block for device code and treat residual hits as high priority.
- Device-Code Sign-In via Authentication Broker or From New Country · unlock with TL Creds
- Device Registration Within 6 Hours of Device-Code Sign-In · unlock with TL Creds
- Device-Code Phishing Lure: Impersonation Sender Domains and Phishing Chain URLs · unlock with TL Creds
- Device-Code Phishing Link Chain via Compromised Redirectors and Google Sites · unlock with TL Creds
- Suspicious Inbox Rule Moving or Deleting Mail to Hidden Folders After Account Takeover · unlock with TL Creds
- DNS Resolution of Device-Code Phishing Endpoints (hlpadditives.com, flosli.com, [indicator]) · unlock with TL Creds
- Device-Code Token Used Against Device Registration Service (deviceCodeFlow) · unlock with TL Creds
- Entra ID Sign-In From Device-Code Phishing Attacker IPs (Trend Micro IOCs) · unlock with TL Creds
Indicators of compromise
As of 2026-11-06, Threadlinqs Intelligence tracks 19 indicators of compromise for TL-2026-5428.
Sample indicators (3 of 19)
- IP address:
104.219.238[.]253 - Domain:
rlcounsel[.]com - IP address:
43.165.1[.]42
Defanged, TLP:CLEAR. Full set of 19 indicators: unlock with TL Creds.
Technical analysis
No password is stolen and MFA is satisfied.
The campaign abuses the OAuth 2.0 device authorization grant (device code flow) in Microsoft Entra ID. The attacker initiates a device-code flow, obtains a user code, and lures the victim into entering that code on the legitimate Microsoft device-login page. Because the victim authenticates (including MFA) on a genuine Microsoft page, Microsoft issues access and refresh tokens to the attacker's polling client. No password is captured and MFA is satisfied, so MFA-based controls provide no protection.
As documented by Trend Micro (2026-07-22), the chain starts with social-engineering contact from impersonation sender domains (a law-firm style lure, e.g. rlcounsel.com and cholaw-kr.co), followed by a phishing link that passes through compromised open redirectors (eusei.com, cineuropa.org, zrdesignlabo.com) to a fake document portal hosted on Google Sites, and then to phishing endpoints (hlpadditives.com and flosli.com subdomains, and a Cloudflare workers.dev page) that present the device-code prompt. Trend detects the credential-harvesting page as HTML.Phish.Microsoft.
Within hours of the victim approving the code, the attacker signed in from abroad, registered devices in Entra ID using the device-code token (token misuse against the Device Registration Service, visible as OriginalTransferMethod deviceCodeFlow), created inbox rules (including rules moving mail to hidden folders), and sent phishing to hundreds of recipients from the compromised mailbox. This mirrors the Authentication Broker client / device registration technique Microsoft described for Storm-2372 in February 2025, but Trend's report names no actor, malware, or hashes and no attribution is made here.
Defensive focus: device-code sign-ins should be rare and can be blocked with Conditional Access; monitor Authentication Broker activity from unfamiliar locations, spikes in device registration, and mailbox rule changes. Require phishing-resistant MFA, managed/compliant devices, named locations, Continuous Access Evaluation, and token protection, and restrict device registration privileges.
MITRE ATT&CK techniques by tactic:
Persistence
T1098.005 Device Registration; T1556.006 Multi-Factor Authentication
Collection
Credential Access
T1528 Steal Application Access Token; T1621 Multi-Factor Authentication Request Generation
lateral-movement
T1550.001 Application Access Token
Lateral Movement
T1550.001 Application Access Token
Defense Evasion
T1564.008 Email Hiding Rules; T1684.001 Impersonation
Initial Access
Resource Development
T1583 Acquire Infrastructure; T1584 Compromise Infrastructure
Remediation
Immediate actions
- Block the listed sender domains, redirector URLs, phishing endpoints, and attacker IPs at the email gateway, proxy, and Entra sign-in policies
- Hunt Entra sign-in logs for authenticationProtocol deviceCode with successful status and review the associated users
- Revoke refresh tokens/sessions and review newly registered devices and mailbox rules (especially rules moving mail to hidden folders) for affected users
Workarounds
- Block the OAuth device-code flow with a Conditional Access authentication-flows policy
- Restrict who can register devices in Entra ID
- Block suspicious inbox rule creation
Longer-term hardening
- Require phishing-resistant MFA
- Enable Continuous Access Evaluation and token protection
- Enforce managed/compliant device requirements and named-location policies
- Alert on device registration spikes, Authentication Broker activity from unfamiliar locations, and impossible-travel sign-ins
- Teach users that an unexpected request to enter or read out a code is a red flag and give them an easy way to report it
Affected and fixed versions
- Microsoft — Microsoft 365 / Microsoft Entra ID (OAuth device code flow)
Vulnerable versions: Tenants permitting device-code flow sign-ins
Fixed in: Tenants blocking device-code flow via Conditional Access
Timeline
- Approximate start (August 2024, day not stated) of the Storm-2372 device-code phishing campaign described by Microsoft, the earlier public reporting of the same technique
- Microsoft publishes its analysis of Storm-2372 device-code phishing against Microsoft Teams-themed lures and recommends blocking device-code flow with Conditional Access
- Microsoft reports Storm-2372 shifting to the Microsoft Authentication Broker client ID in the device-code flow to obtain a refresh token for the Device Registration Service and register an actor-controlled device
- Trend describes the intrusion starting with a law-firm-partner impersonation that builds rapport over multiple emails before the phishing link is introduced (exact dates of the case study not given; report date shown)
- Trend reports that within hours of the victim approving the device code, the attacker signed in from abroad, registered devices, created inbox rules, and sent phishing to hundreds of recipients (observation date not given; report date shown)
- Trend Micro publishes research on observed device-code phishing: law-firm-themed lures, Google Sites lure pages, compromised open redirectors, and five attacker IPs
- Microsoft updates its Storm-2372 analysis, reassessing the cluster as a sub-cluster of Midnight Blizzard; Trend's report makes no attribution of the 2026 campaign to this or any actor
Sources cited
- Device Code Phishing: Turning a Convenience Feature Into an MFA Bypass Trend Micro · Research · 2026-07-22
- Storm-2372 conducts device code phishing campaign Microsoft · Vendor report · 2025-02-13
- Microsoft identity platform and the OAuth 2.0 device authorization grant flow Microsoft · Vendor report
- Conditional Access: Authentication flows condition Microsoft · Vendor report
- MITRE ATT&CK T1621 Multi-Factor Authentication Request Generation MITRE · Research
- MITRE ATT&CK T1528 Steal Application Access Token MITRE · Research
- MITRE ATT&CK T1098.005 Account Manipulation: Device Registration MITRE · Research
- Phishing campaign targets Microsoft device code authentication flows (Cybersecurity Dive) cybersecuritydive.com · News
Previous and next in phishing
Drafted by the Threadlinqs research pipeline from 8 sources; published ; last updated —.
