A financially motivated actor (“Doubloon Dredger”) abused legitimate Notion sharing notifications to trick employees into opening a PDF and completing a Microsoft device-code login flow. This allowed the attacker to harvest authentication tokens and access victim accounts without needing the password. Researchers also observed layered phishing infrastructure and links to phishing-as-a-service platforms like EvilTokens and Tycoon2FA.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
You get a Notion email: your CFO just shared a document you need to review and sign. Looks totally legit, right? But this Doubloon Dredger scam chains three steps: Notion alert, then a PDF with a big 'Review and Sign' button, then an Adobe-looking page that hands you a Microsoft device code. Here’s the twist: they tell you, 'Enter this code on Microsoft’s device-code page.' The Microsoft site is real, but entering that code hands EvilTokens and Tycoon2FA a token to your account, no password needed. If a document you weren’t expecting leads to a PDF and then tells you to enter a code on Microsoft, stop. Message the executive directly on Teams or email and confirm before you touch any code.
This report describes real-world social engineering where victims are tricked into copying and pasting commands that install malware on macOS and Windows. It also highlights device code phishing activity targeting Microsoft Entra ID/Microsoft 365 tokens, enabling attackers to access accounts and…
Google says multiple suspected Russia-linked espionage clusters targeted academics, government, and defense-related personnel by abusing legitimate sign-in features instead of using obvious fake login pages. The campaigns used realistic lures (file sharing, conference invites, and “secure WhatsApp”…
Google says three suspected Russian espionage clusters are targeting academics, think tanks, diplomats, and related nonprofit staff by abusing legitimate login and verification workflows that may not look like “classic phishing.” The campaigns include app-password scams, OAuth/device-code tricks,…
Criminals using the “Greatness” phishing-as-a-service kit are running real-world phishing campaigns that trick employees into approving a Microsoft device-code login flow, allowing attackers to bypass MFA and steal access tokens. Recent activity includes RingCentral “voicemail” lures and multi-step…
Microsoft and ReliaQuest report a real campaign where attackers tampered with public Wi‑Fi captive portal networks (hotels/conference venues) to redirect users to attacker-controlled pages. The goal was to steal Microsoft 365 credentials (and sometimes deliver malware) by using…
This article describes real-world “device code phishing” campaigns where victims are tricked into approving an OAuth device login, granting attackers access without stealing passwords. It highlights rapid criminal adoption via phishing-as-a-service kits and notes heavy targeting of Microsoft…
