Device-Code Phishing and “ClickFix” Lures Spread

This weekly recap highlights multiple real-world campaigns where attackers trick users into taking actions that grant access, without needing to steal passwords directly. Notable examples include “device code” phishing (victims are instructed to enter a short code to approve an attacker session) and a newly weaponized placeholder domain that serves a “ClickFix” lure to Windows users.

Key findings

• A non-reserved placeholder domain (third-party[.]com) was registered by an attacker and used to deliver a Windows-focused “ClickFix lure,” impacting readers of documentation and code that hard-coded the domain.
• A Microsoft-led action dismantled the “EvilTokens” phishing service, which specialized in “device code” phishing, tricking victims into authorizing an attacker’s session without sharing passwords.
• A TeamFiltration campaign targeted Microsoft 365 tenants and successfully compromised unmanaged service/functional accounts, highlighting risk from “forgotten” non-human identities without MFA.
• Konni used spear-phishing with ZIP files containing malicious LNK shortcuts disguised as PDFs to deliver malware to Ukraine-focused targets.

Who’s being targeted

• Commonly targeted roles: All employees, Executives, Finance, IT/Helpdesk, Developers/Engineering, Identity & Access Management (IAM) team.
• Affected industries: Retail, Finance, Government/Public sector, Technology/SaaS (Microsoft 365 tenants).
• Attack channels: email, website.
• Impersonated: IT support or a cloud app sign-in prompt (device activation), Legitimate documentation/reference link (developer docs or internal wiki), A document sender sharing a PDF (actually a shortcut file).

Awareness takeaways

• Treat ‘device code’ requests as high-risk, only enter codes on official sites you navigated to yourself (not from links).
• Don’t trust “placeholder” domains in docs unless they are reserved examples (like example.com) or explicitly approved by your organization.
• Be suspicious of ZIP attachments and ‘PDFs’ that are actually shortcuts (LNK). If a document arrives compressed, verify with the sender via a known channel.
• Harden and monitor service/functional accounts (MFA, password rotation, ownership) because attackers target ‘forgotten’ non-human identities.

Red flags to watch for

• Any request to enter a ‘short code’ into a link/page you didn’t initiate
• Message claims you must ‘complete authentication’ but you never started a login
• Unusual urgency to approve access for a ‘device’ you don’t recognize
• Links that look like documentation placeholders but are real, registered domains
• Site shows different content depending on device/OS (decoy vs lure)
• Unexpected ‘fix your system’ prompts when you expected documentation
• ‘PDF’ file that is actually a shortcut (.LNK), especially inside a ZIP
• Unexpected compressed attachment for a simple document
• File icon/name looks like a PDF but file type/extension is suspicious