Researchers at ANY.RUN report a real-world phishing operation (“Wazza”) targeting banking, government, and manufacturing in the U.S., Europe, and Australia. The campaign uses a multi-step redirect and validation chain to filter out bots and only then shows an Adobe-branded “Device Code” sign-in page designed to trick victims into completing an authentication step that gives attackers account access.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
You get an email: "Action required: Complete sign-in using Device Code" for Adobe. Looks routine, right? Behind that link is the Wazza phishkit. It quietly routes you through boegl-krysl.eu and check.boegl-krysl.eu, filtering out scanners, then drops you on an Adobe-themed Device Code page. Here’s the trick: the page looks like Adobe, but it’s using a Device Code flow to hijack your authentication, not just your password. You think you’re approving your own sign-in, they’re actually taking over your account. If you didn’t start a sign-in yourself, especially one using a Device Code, stop. Close it and report it to Security right away.
This article describes real-world “device code phishing” campaigns where victims are tricked into approving an OAuth device login, granting attackers access without stealing passwords. It highlights rapid criminal adoption via phishing-as-a-service kits and notes heavy targeting of Microsoft…
Researchers observed a real phishing campaign (“CSuite”) heavily targeting U.S. organizations using familiar business-themed lures (DocuSign, Adobe, Zoom/Meet, Dropbox, Microsoft 365). After a victim engages, the attackers either steal Microsoft 365 sessions (enabling mailbox takeover and fraud) or…
Microsoft and partners disrupted “EvilTokens,” a phishing-as-a-service platform Microsoft links to over 12,000 compromised inboxes across more than 10,000 organizations. The service used deceptive emails to trick people into pasting a “device code” into Microsoft’s real sign-in page…
A SecurityWeek roundup highlights multiple real-world scams and campaigns where attackers trick people rather than “hack” systems directly. Notable items include OAuth “consent phishing” (getting users to approve a malicious app’s access), and phishing-evasion using invisible Unicode characters…
The article describes how real-world attackers are shifting common breach activity into the web browser, including phishing that steals live sessions, fake “copy/paste to fix” prompts (ClickFix), and OAuth consent/device-code tricks. It highlights how these browser-based lures can bypass MFA and…
The article describes how real-world phishing and social engineering are evolving to bypass the checks employees are trained to use (bad grammar, suspicious URLs, obvious fake login pages). It highlights specific, observed attack workflows including QR-code “device hop” phishing, OAuth token theft…
