# Microsoft Teams Booking-Flow Lure Used for Device Code Phishing Against Construction Sector

> A spear-phishing campaign impersonating a senior vice president at another construction firm used a fake Microsoft Teams meeting scheduler to trick a construction-company employee into approving an attacker-initiated Microsoft device code sign-in, yielding a valid session token. The kit delivered its payload as AES-256-GCM ciphertext to evade non-JavaScript scanners and relayed the final login through a residential proxy.

- **Published:** 2026-11-13T06:34:08Z
- **Last reviewed:** 2026-11-13T06:34:08Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-5935
- **Card image:** https://intel.threadlinqs.com/og/threat/TL-2026-5935.png
- **ID:** TL-2026-5935
- **Severity:** HIGH
- **Category:** PHISHING
- **Status:** ACTIVE
- **Detections:** 9 (1 shown free below) · **IOCs:** 13 (3 shown free below)

## Description

Huntress SOC investigated an incident in mid-October 2026 in which an employee of a construction company received a spear-phishing email from a typosquatted domain that impersonated a real senior vice president at another construction company. The typosquatted domain was registered about eight days before the attack and the mail was hosted on Zoho Mail. The email body did not contain the phishing domain: the link was wrapped by Microsoft Safe Links (nam12.safelinks.protection.outlook.com) and pointed to a Google share short link (share.google), which redirected server-side through google.com/share.google to the lure page, defeating URL-reputation checks.

The lure page imitated a 'Microsoft Teams Meeting Scheduler', showing the executive's headshot and offering an introductory call about a supply partnership. The victim chose a date, time and duration; nothing was sent to the server until 'Continue' was clicked. Before calling the backend the page resolved the visitor's country via /cdn-cgi/trace, /api/visitor/country or a Cloudflare fallback. On 'Continue' the page issued a body-less POST to /static-export/api/device/start on the attacker backend, which started a genuine Microsoft device code authorization flow and returned a user_code. The page displayed that code as a 'Booking Reference' with a 'Confirm Booking' button and a session-expiration countdown timer. 'Copy' or 'Confirm Meeting' placed the code on the clipboard and opened a popup to the legitimate microsoft.com/devicelogin page, where the victim pasted the code and completed sign-in. When the backend detected success, the popup closed, the page displayed 'Verification complete' and the victim was redirected to a real Calendly booking page as cover.

The phishing site was a small loader; the real kit was stored as AES-256-GCM ciphertext with the key and IV embedded in the page and decrypted in the browser with WebCrypto, so crawlers that do not execute JavaScript only saw an encrypted blob. The decrypted kit hooked window.open and two fetch calls and routed API traffic to the backend at gpimmlgration.com. Observed request headers included X-Antibot-Token, X-Auth-Mode: cookie, X-WinHello: 1 and Idempotency-Key: web-<uuid>. If the backend returned a mirror_url, the victim was shown a fake Microsoft pop-up claiming sign-in succeeded and requesting 'additional verification' on the device (WinHello stage). In token mode, if Microsoft returned AADSTS50076 or interaction_required (typically when MFA is required), the kit started a new device code session and told the victim a new verification code was being prepared.

The attacker obtained tokens for the Microsoft Authentication Broker client, visible in sign-in logs as a 'Cmsi:Cmsi' authentication. That flow was relayed through a residential callback proxy that Huntress tied to a home internet connection in New Orleans with no other observed malicious activity. The captured session was replayed from attacker infrastructure, with the ASN and region changing within the same session ID, and programmatic user agents such as python-requests and node appeared in sign-in logs (python-requests possibly only in non-interactive logs). The victim Microsoft 365 account had no MFA enrolled and signed in from a non-compliant, unmanaged device. Huntress contained the incident before the attacker escalated. The threat actor is not named, no CVE is involved, and the sources publish no IP addresses, hashes or application IDs; the typosquatted sender domain was redacted.

Context: Trend Micro (22 July 2026) documented a separate device-code campaign in which Authentication Broker approvals led to rogue device registrations, hidden inbox rules and onward phishing from the mailbox; the same follow-on activity is the logical post-compromise risk here and is why Huntress advises checking rogue MFA methods, registered devices, app consents and mailbox rules. ThaiCERT (7 April 2026), citing Push Security, reported device code phishing pages up roughly 37.5x in early 2026 with at least 11 phishing-as-a-service kits.

## MITRE ATT&CK

- T1583.001 Domains
- T1608.005 Link Target
- T1566.002 Spearphishing Link
- T1684.001 Impersonation
- T1204.001 Malicious Link
- T1027.013 Encrypted/Encoded File
- T1078.004 Cloud Accounts
- T1528 Steal Application Access Token
- T1539 Steal Web Session Cookie
- T1557 Adversary-in-the-Middle
- T1550.004 Web Session Cookie
- T1550.001 Application Access Token
- T1090 Proxy

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**Proxy Traffic to gpimmlgration.com Device-Code Backend and Teams Lure Paths** (`TL-2026-5935-SPL-003`)

Detects web-gateway requests to the TL-2026-5935 kit backend gpimmlgration.com, the body-less POST endpoint /static-export/api/device/start that spawns the Microsoft device code session, and the two Teams Meeting scheduler lure directories. A hit on device/start means the victim loaded the lure and pressed Continue.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1583.001, T1608.005, T1566.002, T1090
- **Data sources:** proxy, zscalernss-web, pan:url, CommonSecurityLog, DeviceNetworkEvents
- **Severity:** critical
- **Confidence:** high

### Splunk SPL

````spl
index=proxy sourcetype IN ("zscalernss-web","pan:url","bluecoat:proxysg:access:syslog") ("gpimmlgration.com" OR "/static-export/api/device/start" OR "%20Book%20a%20Microsoft%20Teams%20Meeting" OR "/Teams%20Microsoft%20Meeting/") earliest=-24h ```TL-2026-5935 kit backend (gpimmlgration.com), device-code start endpoint and Teams-scheduler lure directories```
| eval hit_backend=if(match(_raw,"(?i)gpimmlgration[.]com"),1,0), hit_start=if(match(_raw,"(?i)/static-export/api/device/start"),1,0), hit_lure=if(match(_raw,"(?i)(%20| )Book(%20| )a(%20| )Microsoft(%20| )Teams(%20| )Meeting|/Teams(%20| )Microsoft(%20| )Meeting/"),1,0)
| eval user=coalesce(user, src_user, cs_username, "unknown"), src=coalesce(src_ip, src, c_ip)
| stats count min(_time) AS first_seen max(_time) AS last_seen max(hit_backend) AS backend max(hit_start) AS device_code_start max(hit_lure) AS lure_page values(url) AS urls BY user src
| eval severity=case(device_code_start=1,"critical", backend=1,"high", true(),"medium")
| convert ctime(first_seen) ctime(last_seen)
| table user src severity backend device_code_start lure_page urls count first_seen last_seen
````

### Microsoft KQL

```kql
let ioc_hosts = dynamic(["gpimmlgration.com"]);
let ioc_paths = dynamic(["/static-export/api/device/start", "%20Book%20a%20Microsoft%20Teams%20Meeting", "/Teams%20Microsoft%20Meeting/", " Book a Microsoft Teams Meeting", "/Teams Microsoft Meeting/"]);
union
(CommonSecurityLog
| where TimeGenerated > ago(24h)
| where RequestURL has_any (ioc_hosts) or RequestURL has_any (ioc_paths) or DestinationHostName has_any (ioc_hosts)
| project TimeGenerated, Source = "CommonSecurityLog", User = SourceUserName, Device = DeviceVendor, SrcIP = SourceIP, Url = coalesce(RequestURL, DestinationHostName)),
(DeviceNetworkEvents
| where Timestamp > ago(24h)
| where RemoteUrl has_any (ioc_hosts) or RemoteUrl has_any (ioc_paths)
| project TimeGenerated = Timestamp, Source = "DeviceNetworkEvents", User = InitiatingProcessAccountUpn, Device = DeviceName, SrcIP = LocalIP, Url = RemoteUrl)
| extend DeviceCodeStart = Url has "/static-export/api/device/start", Backend = Url has "gpimmlgration.com"
| summarize Hits = count(), Urls = make_set(Url, 10), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated), DeviceCodeStart = max(toint(DeviceCodeStart)), Backend = max(toint(Backend)) by User, Device, SrcIP
| order by DeviceCodeStart desc, Hits desc
```

### Sigma

```yaml
title: Web Proxy Access to Teams Booking Device-Code Phishing Backend
id: 9d3f9c40-5e6f-4a0c-b132-8c4d9eafb003
status: experimental
description: Detects web proxy requests to gpimmlgration.com, the /static-export/api/device/start device-code start endpoint, or the Teams meeting scheduler lure directories used in TL-2026-5935.
references:
    - https://www.huntress.com/blog/crafty-microsoft-teams-booking-flow-disguises-device-code-phishing
    - https://www.helpnetsecurity.com/2026/11/13/microsoft-teams-device-code-phishing/
    - https://www.trendmicro.com/en_us/research/26/g/device-code-phishing.html
author: Threadlinqs Team
date: 2026-11-13
tags:
    - attack.resource-development
    - attack.t1583.001
    - attack.t1608.005
    - attack.initial-access
    - attack.t1566.002
    - attack.command-and-control
    - attack.t1090
logsource:
    category: proxy
detection:
    selection_host:
        cs-host|endswith: 'gpimmlgration.com'
    selection_path:
        c-uri|contains:
            - '/static-export/api/device/start'
            - '/%20Book%20a%20Microsoft%20Teams%20Meeting/'
            - '/Teams%20Microsoft%20Meeting/'
    condition: 1 of selection_*
falsepositives:
    - Security researchers or sandboxes detonating the URLs
    - Threat-intel enrichment tools fetching the lure pages
level: high

```

**Known false positives:**

- Researchers and sandboxes visiting the indicators
- Unrelated business traffic is not expected to match; no known business false positive

**Tuning notes:** Add additional kit domains from future reporting to the host list. Adjust sourcetypes and user/src field names to your gateway. Treat any device/start hit as an incident and review the user's Entra sign-ins for Cmsi:Cmsi.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- Safe Links Click on Google Share Redirector or Teams Lure — Executive Impersonation Delivery (locked: unlock with TL Creds)
- Entra Session Replayed From Multiple ASNs and Regions (locked: unlock with TL Creds)
- Device Registration, MFA Method or Consent Change After Device-Code Sign-In (locked: unlock with TL Creds)
- Device Code Flow MFA Fallback (AADSTS50076) — Repeated Code Sessions (locked: unlock with TL Creds)
- Hidden or Forwarding Inbox Rule Created After Device-Code Compromise (locked: unlock with TL Creds)
- DNS Resolution of [indicator] Device-Code Kit Backend (locked: unlock with TL Creds)
- Device Code Sign-In via Authentication Broker (Cmsi:Cmsi) — Teams Booking Lure (locked: unlock with TL Creds)
- Programmatic User Agent (python-requests / node) Token Replay in Entra Sign-Ins (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (3 of 13)

Defanged, TLP:CLEAR.

- Domain: `gpimmlgration[.]com`
- URL: `hxxps://share[.]google/?q=UltJkMsVWI5V9GJM1`
- Domain: `nam12[.]safelinks[.]protection[.]outlook[.]com`

Full set of 13 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [Huntress: Crafty Microsoft Teams Booking Flow Disguises Device Code Phishing](https://www.huntress.com/blog/crafty-microsoft-teams-booking-flow-disguises-device-code-phishing)
- [Help Net Security: How attackers turned a Teams meeting booking into a device code phishing trap](https://www.helpnetsecurity.com/2026/11/13/microsoft-teams-device-code-phishing/)
- [ThaiCERT: Alert - Surge in Device Code Phishing Attacks, Up 37x in 2026](https://www.thaicert.or.th/en/2026/04/07/alert-surge-in-device-code-phishing-attacks-up-37x-in-2026/)
- [Trend Micro: Device code phishing](https://www.trendmicro.com/en_us/research/26/g/device-code-phishing.html)
- [Malwarebytes: How device code phishing gives scammers access to your account](https://www.malwarebytes.com/blog/how-to/2026/09/how-device-code-phishing-gives-scammers-access-to-your-account)
- [Netlas: Device Code Phishing - Technical Analysis and Proactive Hunting](https://netlas.io/blog/device_code_phishing/)
- [Push Security: Device code phishing technique](https://phishing-techniques.pushsecurity.com/techniques/device-code-phishing/)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-5935