Netcrook
#device code phishing
Forg365 Turns Microsoft 365 Phishing Into a Bought-and-Sold Access Business
A Telegram-linked phishing service shows how identity theft now borrows the mechanics of SaaS, combining device-code abuse, token persistence, and AI-written lures.
When the Login Box Becomes the Breach: Device-Code Phishing and MFA Persistence
Identity abuse is replacing noisy malware in some intrusions, and the sharp edge now sits in legitimate sign-in flows, token replay, and methods added to keep access alive.
Microsoft’s Device Code Flow Is Becoming a Rental Service for Account Takeovers
A late-June phishing run against Microsoft 365 shows how attackers are industrializing a legitimate sign-in method, turning trusted authentication into a reusable identity-abuse chain.
When the Login Page Is Real: The Device-Code Phishing Playbook Targeting Microsoft Accounts
A legitimate Microsoft sign-in path built for low-input devices is being repurposed as a phishing lure, shifting the attack from password theft to trusted-session abuse.
Real Microsoft Sign-Ins, Fake Trust: How PDF Lures Are Steering Victims Into Device Code Phishing
A phishing campaign is blending password-protected PDFs with Microsoft’s legitimate device-code login flow, a reminder that attackers do not always need fake pages when they can abuse the real ones.
When Microsoft Sign-In Becomes the Trap: ARToken and the New Token-Theft Playbook
A phishing kit tied to Microsoft 365 targeting shows how attackers can lean on legitimate cloud login flows, trusted collaboration branding, and edge-hosted delivery to turn identity into the attack surface.
The ARToken Panel Shows How Phishing Became a Token Factory
A React-based phishing-as-a-service panel reportedly built for Microsoft 365 abuse points to a quieter threat: industrialized token handling, not just stolen passwords.
The Quiet MFA Bypass Hiding Inside a Legitimate Login Flow
A webinar on MFA bypass underscores a harder truth for defenders: the sharpest phishing campaigns now abuse valid authentication paths, then rely on behavioral detection to catch the fallout.
When the Login Page Is Real: The Quiet Power of Device Code Phishing
A phishing campaign aimed at Microsoft 365 users shows how attackers can abuse a legitimate OAuth flow instead of building a fake login page.
The Real Login Trap: How Device Code Prompts Can Turn Microsoft 365 Into a Token Prize
A legitimate Microsoft sign-in path can be twisted into an authorization relay, letting an attacker win access after the victim approves the wrong device.
When a Real Microsoft Login Becomes the Trap
A phishing service built around OAuth device code flow shows how attackers can turn a legitimate sign-in path into token theft, session hijacking, and MFA bypass.
When the Password Is Not the Prize: The Microsoft 365 Token Grab Hidden Inside Kali365
A phishing kit linked to Telegram distribution is pushing attackers toward session theft, turning a successful sign-in into a longer-lived foothold inside cloud accounts.
Code on the Screen, Control in the Attacker’s Hands
A legitimate Microsoft sign-in flow is being repurposed as a phishing lure, and Australian guidance now treats that abuse as a real identity risk rather than a curiosity.
When a Legitimate Login Becomes the Trap: Device-Code Phishing Targets Microsoft 365
Attackers are abusing a real OAuth sign-in path to turn user cooperation into token theft, shifting the fight from passwords to the identity layer itself.
The Login That Looked Legit: How Device Code Phishing Turns Microsoft 365 Into a Token Trap
Attackers are abusing a standard cross-device sign-in path to steal Microsoft 365 tokens, sidestep ordinary MFA expectations, and turn a trusted identity workflow into a foothold for mailbox abuse.