Tradecraft Tuesday | We Need to Talk About Device Code Phishing

Huntress researchers Jenko Wong and Dave Clantland demonstrate how device code phishing exploits OAuth to steal Microsoft tokens, escalate privileges, and achieve persistent access 0:29.

Key Takeaways:
• Device code flow, designed for devices without keyboards like smart TVs, can be weaponized when attackers impersonate legitimate Microsoft apps to trick users into authenticating on real Microsoft pages 8:15.
• Attackers can exchange an Outlook token for Azure management tokens through Microsoft's "family of client IDs" feature, enabling lateral movement to broader resources without additional user consent 17:30.
• Advanced attacks hijack device registration services to obtain Primary Refresh Tokens and Windows Hello for Business keys, providing near-permanent access that's difficult to detect and revoke 22:00.
• The Evil Tokens campaign demonstrated large-scale device code phishing using compromised websites, Railway proxies, and Cloudflare workers to evade traditional security controls 28:00.
• Defenses include conditional access policies to block device code flow, monitoring for suspicious new device registrations, and analyzing logs for anomalous token exchanges across resources 40:00.

Device code phishing represents a sophisticated abuse of OAuth protocols where attackers bypass traditional phishing indicators by directing users to legitimate authentication pages, making this attack particularly challenging to detect and prevent through user training alone.

Sources:

• 0:29 Introduction to device code fishing topic
• 8:15 OAuth