Skip to navigation

Threat reportPhishingTL-2026-5935

Microsoft Teams Booking-Flow Lure Used for Device Code Phishing Against Construction Sector

highACTIVE

A spear-phishing campaign impersonating a senior vice president at another construction firm used a fake Microsoft Teams meeting scheduler to trick a construction-company employee into approving an attacker-initiated Microsoft device code sign-in, yielding a valid session token. The kit delivered its payload as AES-256-GCM ciphertext to evade non-JavaScript scanners and relayed the final login through a residential proxy.

Key facts

IdentifiersTL-2026-5935
SeverityHIGH
First disclosed
Affected productsMicrosoft Microsoft Entra ID / Microsoft 365 (OAuth 2.0 device authorization grant)
MITRE ATT&CK techniquesT1027.013 Encrypted/Encoded File, T1078.004 Cloud Accounts, T1090 Proxy, T1204.001 Malicious Link, T1528 Steal Application Access Token, T1539 Steal Web Session Cookie, T1550.001 Application Access Token, T1550.004 Web Session Cookie, T1557 Adversary-in-the-Middle, T1566.002 Spearphishing Link, T1583.001 Domains, T1608.005 Link Target and 1 more in the attack flow
MotivationUNKNOWN
Target sectorsconstruction
Target regionsNorth America
Detection rules9 (1 shown free)
Sources7 cited sources

Detection coverage

As of 2026-11-13, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5935 across Splunk SPL, Microsoft KQL and Sigma, covering 13 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: Proxy Traffic to gpimmlgration.com Device-Code Backend and Teams Lure Paths

Detects web-gateway requests to the TL-2026-5935 kit backend gpimmlgration.com, the body-less POST endpoint /static-export/api/device/start that spawns the Microsoft device code session, and the two Teams Meeting scheduler lure directories. A hit on device/start means the victim loaded the lure and pressed Continue.

  • Languages: Splunk SPL, Microsoft KQL, Sigma
  • ATT&CK: T1583.001, T1608.005, T1566.002, T1090
  • Data sources: proxy, zscalernss-web, pan:url, CommonSecurityLog, DeviceNetworkEvents
  • Severity: critical
  • Confidence: high

Splunk SPL

index=proxy sourcetype IN ("zscalernss-web","pan:url","bluecoat:proxysg:access:syslog") ("gpimmlgration.com" OR "/static-export/api/device/start" OR "%20Book%20a%20Microsoft%20Teams%20Meeting" OR "/Teams%20Microsoft%20Meeting/") earliest=-24h ```TL-2026-5935 kit backend (gpimmlgration.com), device-code start endpoint and Teams-scheduler lure directories```
| eval hit_backend=if(match(_raw,"(?i)gpimmlgration[.]com"),1,0), hit_start=if(match(_raw,"(?i)/static-export/api/device/start"),1,0), hit_lure=if(match(_raw,"(?i)(%20| )Book(%20| )a(%20| )Microsoft(%20| )Teams(%20| )Meeting|/Teams(%20| )Microsoft(%20| )Meeting/"),1,0)
| eval user=coalesce(user, src_user, cs_username, "unknown"), src=coalesce(src_ip, src, c_ip)
| stats count min(_time) AS first_seen max(_time) AS last_seen max(hit_backend) AS backend max(hit_start) AS device_code_start max(hit_lure) AS lure_page values(url) AS urls BY user src
| eval severity=case(device_code_start=1,"critical", backend=1,"high", true(),"medium")
| convert ctime(first_seen) ctime(last_seen)
| table user src severity backend device_code_start lure_page urls count first_seen last_seen

Microsoft KQL

let ioc_hosts = dynamic(["gpimmlgration.com"]);
let ioc_paths = dynamic(["/static-export/api/device/start", "%20Book%20a%20Microsoft%20Teams%20Meeting", "/Teams%20Microsoft%20Meeting/", " Book a Microsoft Teams Meeting", "/Teams Microsoft Meeting/"]);
union
(CommonSecurityLog
| where TimeGenerated > ago(24h)
| where RequestURL has_any (ioc_hosts) or RequestURL has_any (ioc_paths) or DestinationHostName has_any (ioc_hosts)
| project TimeGenerated, Source = "CommonSecurityLog", User = SourceUserName, Device = DeviceVendor, SrcIP = SourceIP, Url = coalesce(RequestURL, DestinationHostName)),
(DeviceNetworkEvents
| where Timestamp > ago(24h)
| where RemoteUrl has_any (ioc_hosts) or RemoteUrl has_any (ioc_paths)
| project TimeGenerated = Timestamp, Source = "DeviceNetworkEvents", User = InitiatingProcessAccountUpn, Device = DeviceName, SrcIP = LocalIP, Url = RemoteUrl)
| extend DeviceCodeStart = Url has "/static-export/api/device/start", Backend = Url has "gpimmlgration.com"
| summarize Hits = count(), Urls = make_set(Url, 10), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated), DeviceCodeStart = max(toint(DeviceCodeStart)), Backend = max(toint(Backend)) by User, Device, SrcIP
| order by DeviceCodeStart desc, Hits desc

Sigma

title: Web Proxy Access to Teams Booking Device-Code Phishing Backend
id: 9d3f9c40-5e6f-4a0c-b132-8c4d9eafb003
status: experimental
description: Detects web proxy requests to gpimmlgration.com, the /static-export/api/device/start device-code start endpoint, or the Teams meeting scheduler lure directories used in TL-2026-5935.
references:
    - https://www.huntress.com/blog/crafty-microsoft-teams-booking-flow-disguises-device-code-phishing
    - https://www.helpnetsecurity.com/2026/11/13/microsoft-teams-device-code-phishing/
    - https://www.trendmicro.com/en_us/research/26/g/device-code-phishing.html
author: Threadlinqs Team
date: 2026-11-13
tags:
    - attack.resource-development
    - attack.t1583.001
    - attack.t1608.005
    - attack.initial-access
    - attack.t1566.002
    - attack.command-and-control
    - attack.t1090
logsource:
    category: proxy
detection:
    selection_host:
        cs-host|endswith: 'gpimmlgration.com'
    selection_path:
        c-uri|contains:
            - '/static-export/api/device/start'
            - '/%20Book%20a%20Microsoft%20Teams%20Meeting/'
            - '/Teams%20Microsoft%20Meeting/'
    condition: 1 of selection_*
falsepositives:
    - Security researchers or sandboxes detonating the URLs
    - Threat-intel enrichment tools fetching the lure pages
level: high

Known false positives:

  • Researchers and sandboxes visiting the indicators
  • Unrelated business traffic is not expected to match; no known business false positive

Tuning notes: Add additional kit domains from future reporting to the host list. Adjust sourcetypes and user/src field names to your gateway. Treat any device/start hit as an incident and review the user's Entra sign-ins for Cmsi:Cmsi.

8 more detection rules (Splunk SPL, Microsoft KQL, Sigma) · unlock with TL Creds. Sign up free to unlock the detection rules or query them with the Threadlinqs MCP server (Purple)
  • Safe Links Click on Google Share Redirector or Teams Lure — Executive Impersonation Delivery · unlock with TL Creds
  • Entra Session Replayed From Multiple ASNs and Regions · unlock with TL Creds
  • Device Registration, MFA Method or Consent Change After Device-Code Sign-In · unlock with TL Creds
  • Device Code Flow MFA Fallback (AADSTS50076) — Repeated Code Sessions · unlock with TL Creds
  • Hidden or Forwarding Inbox Rule Created After Device-Code Compromise · unlock with TL Creds
  • DNS Resolution of [indicator] Device-Code Kit Backend · unlock with TL Creds
  • Device Code Sign-In via Authentication Broker (Cmsi:Cmsi) — Teams Booking Lure · unlock with TL Creds
  • Programmatic User Agent (python-requests / node) Token Replay in Entra Sign-Ins · unlock with TL Creds

Indicators of compromise

As of 2026-11-13, Threadlinqs Intelligence tracks 13 indicators of compromise for TL-2026-5935.

Sample indicators (3 of 13)

  • Domain: gpimmlgration[.]com
  • URL: hxxps://share[.]google/?q=UltJkMsVWI5V9GJM1
  • Domain: nam12[.]safelinks[.]protection[.]outlook[.]com

Defanged, TLP:CLEAR. Full set of 13 indicators: unlock with TL Creds.

13 indicators of compromise · unlock with TL Creds. Compare plans

Community OSINT corroboration

1 of this threat's indicators have also been reported by the open-source security community. Community sightings are unverified and are kept separate from Threadlinqs' curated indicators. Indicator values, reporters and campaign linkage are available to authenticated Red-tier users.

Technical analysis

Huntress SOC investigated an incident in mid-October 2026 in which an employee of a construction company received a spear-phishing email from a typosquatted domain that impersonated a real senior vice president at another construction company. The typosquatted domain was registered about eight days before the attack and the mail was hosted on Zoho Mail. The email body did not contain the phishing domain: the link was wrapped by Microsoft Safe Links (nam12.safelinks.protection.outlook.com) and pointed to a Google share short link (share.google), which redirected server-side through google.com/share.google to the lure page, defeating URL-reputation checks.

The lure page imitated a 'Microsoft Teams Meeting Scheduler', showing the executive's headshot and offering an introductory call about a supply partnership. The victim chose a date, time and duration; nothing was sent to the server until 'Continue' was clicked. Before calling the backend the page resolved the visitor's country via /cdn-cgi/trace, /api/visitor/country or a Cloudflare fallback. On 'Continue' the page issued a body-less POST to /static-export/api/device/start on the attacker backend, which started a genuine Microsoft device code authorization flow and returned a user_code. The page displayed that code as a 'Booking Reference' with a 'Confirm Booking' button and a session-expiration countdown timer. 'Copy' or 'Confirm Meeting' placed the code on the clipboard and opened a popup to the legitimate microsoft.com/devicelogin page, where the victim pasted the code and completed sign-in. When the backend detected success, the popup closed, the page displayed 'Verification complete' and the victim was redirected to a real Calendly booking page as cover.

The phishing site was a small loader; the real kit was stored as AES-256-GCM ciphertext with the key and IV embedded in the page and decrypted in the browser with WebCrypto, so crawlers that do not execute JavaScript only saw an encrypted blob. The decrypted kit hooked window.open and two fetch calls and routed API traffic to the backend at gpimmlgration.com. Observed request headers included X-Antibot-Token, X-Auth-Mode: cookie, X-WinHello: 1 and Idempotency-Key: web-<uuid>. If the backend returned a mirror_url, the victim was shown a fake Microsoft pop-up claiming sign-in succeeded and requesting 'additional verification' on the device (WinHello stage). In token mode, if Microsoft returned AADSTS50076 or interaction_required (typically when MFA is required), the kit started a new device code session and told the victim a new verification code was being prepared.

The attacker obtained tokens for the Microsoft Authentication Broker client, visible in sign-in logs as a 'Cmsi:Cmsi' authentication. That flow was relayed through a residential callback proxy that Huntress tied to a home internet connection in New Orleans with no other observed malicious activity. The captured session was replayed from attacker infrastructure, with the ASN and region changing within the same session ID, and programmatic user agents such as python-requests and node appeared in sign-in logs (python-requests possibly only in non-interactive logs). The victim Microsoft 365 account had no MFA enrolled and signed in from a non-compliant, unmanaged device. Huntress contained the incident before the attacker escalated. The threat actor is not named, no CVE is involved, and the sources publish no IP addresses, hashes or application IDs; the typosquatted sender domain was redacted.

Context: Trend Micro (22 July 2026) documented a separate device-code campaign in which Authentication Broker approvals led to rogue device registrations, hidden inbox rules and onward phishing from the mailbox; the same follow-on activity is the logical post-compromise risk here and is why Huntress advises checking rogue MFA methods, registered devices, app consents and mailbox rules. ThaiCERT (7 April 2026), citing Push Security, reported device code phishing pages up roughly 37.5x in early 2026 with at least 11 phishing-as-a-service kits.

MITRE ATT&CK techniques by tactic:

Defense Evasion

T1027.013 Encrypted/Encoded File; T1078.004 Cloud Accounts

Command and Control

T1090 Proxy

Execution

T1204.001 Malicious Link

Credential Access

T1528 Steal Application Access Token; T1539 Steal Web Session Cookie; T1557 Adversary-in-the-Middle

Lateral Movement

T1550.001 Application Access Token; T1550.004 Web Session Cookie

Initial Access

T1566.002 Spearphishing Link

Resource Development

T1583.001 Domains; T1608.005 Link Target

stealth

T1684.001 Impersonation

Remediation

Immediate actions

  • Block or sinkhole gpimmlgration.com and the observed lure paths at web and email gateways
  • Hunt Entra ID sign-in logs (interactive and non-interactive) for device code flow authentications and 'Cmsi:Cmsi' (Microsoft Authentication Broker) sign-ins, especially from unmanaged or non-compliant devices
  • Flag sessions whose ASN or region changes mid-session and sign-ins with python-requests or node user agents
  • If compromise is suspected, revoke sessions and refresh tokens and check for rogue MFA methods, unrecognized registered devices, unauthorized app consents, suspicious mailbox rules and suspicious outbound mail

Workarounds

  • Restrict device code authentication flow with Conditional Access wherever it is not business-required, and monitor it where it is required

Longer-term hardening

  • Enforce phishing-resistant MFA and enroll MFA for all Microsoft 365 accounts
  • Require compliant or managed devices through conditional access
  • Train users to verify any request to enter a code with a known contact before entering it on a Microsoft sign-in page
  • Monitor sign-ins routed through residential proxy infrastructure

Affected and fixed versions

  • Microsoft — Microsoft Entra ID / Microsoft 365 (OAuth 2.0 device authorization grant)
    Vulnerable versions: Tenants permitting device code flow without Conditional Access restriction

Timeline

  • ThaiCERT publishes an alert (citing Push Security) on a surge in device code phishing, reported as roughly 37.5x in early 2026 with at least 11 phishing-as-a-service kits, providing background for the technique.
  • Trend Micro publishes research on a separate device-code phishing campaign abusing the Microsoft Authentication Broker, with rogue device registration and hidden inbox rules as follow-on activity.
  • Malwarebytes publishes a explainer on device code phishing noting fake Teams invites and document-sharing requests as common lures.
  • Approximate date: the typosquatted sender domain is registered about eight days before the attack (exact date not published; mail hosted on Zoho Mail).
  • Approximate date (exact time not published): Huntress SOC identifies the incident after the token was obtained and contains it before the attacker escalates; the victim account had no MFA and used an unmanaged device.
  • Approximate date (reported only as mid-October): a construction-company employee receives the spear-phishing email, starts the Teams-scheduler device code flow, and the attacker obtains a valid session token via the Cmsi:Cmsi flow relayed through a residential proxy.
  • Huntress publishes 'Crafty Microsoft Teams Booking Flow Disguises Device Code Phishing' with technical analysis of the kit and IOCs.
  • Help Net Security publishes coverage of the Huntress research.

Sources cited

Drafted by the Threadlinqs research pipeline from 7 sources; published ; last updated —.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

// threat_feed
$ sort --newest
Showing all threats

Live intelligence console

Threat level

Latest Threats