Researchers report Kali365 is actively targeting US organizations using “device code phishing” that sends victims through Microsoft’s real login flow. Instead of stealing passwords directly, the attacker gets OAuth access and refresh tokens after the user approves a code, enabling ongoing access to Microsoft 365 email and files with fewer obvious phishing signs.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
You get this: “A document was shared with you in SharePoint. Continue to Microsoft device login and enter this code.” Looks normal, right? This is Kali365’s device code phishing. You click, and it sends you to the real Microsoft device login page. You type the code, sign in like usual, and they grab OAuth tokens to your email and files without ever stealing your password. Here’s the trap: the Microsoft page is real, but the code isn’t. You never asked for it. For a simple shared file or DocuSign review, being forced into a device-code login is weird, that’s your red flag. If you see a device code prompt you didn’t start yourself, stop. Don’t enter the code, close it and report it to security.
Researchers described an active phishing operation using real DocuSign notifications to trick employees into opening a fake “remittance-advice” document and clicking a hidden malicious link. The attack routes victims through legitimate Microsoft/Google pages before landing on an…
The article describes how attackers use QR codes in emails (“quishing”) to hide malicious links, push victims onto less-protected mobile phones, and steal credentials or MFA tokens. It also cites an FBI notice describing North Korea’s Kimsuky using QR codes in spearphishing emails targeting think…
Researchers described a real phishing campaign where victims click through legitimate Microsoft services and end up on a fake login page that is generated inside their own browser. The phishing page uses a temporary “blob URL” (not a normal website) and can disappear after the session, making it…
Researchers reported a real phishing campaign that uses legitimate Microsoft OAuth and Teams pages to make the journey look trustworthy. Instead of hosting a fake login site on a suspicious domain, the attackers render the phishing page inside the victim’s own browser using a temporary “blob URL,”…
Barracuda observed a real phishing campaign that avoids hosting a traditional fake website. Instead, victims are led through Microsoft Teams to load a resource that their browser converts into a “blob URL,” rendering the phishing page only inside the victim’s browser, making it harder for scanners…
A commercial phishing service called NovaCookies is being marketed as a subscription that can hijack Microsoft 365 sessions even when MFA is enabled. Research describes how it uses legitimate-looking delivery (e.g., real DocuSign envelopes and trusted redirect endpoints) to trick users into…
