{"id":26193,"date":"2026-09-21T15:14:48","date_gmt":"2026-09-21T23:14:48","guid":{"rendered":"https:\/\/www.palada.net\/index.php\/2026\/09\/21\/hunting-device-code-phishing-pages\/"},"modified":"2026-09-21T15:14:48","modified_gmt":"2026-09-21T23:14:48","slug":"hunting-device-code-phishing-pages","status":"publish","type":"post","link":"http:\/\/www.palada.net\/index.php\/2026\/09\/21\/hunting-device-code-phishing-pages\/","title":{"rendered":"Hunting Device Code Phishing Pages"},"content":{"rendered":"
\n
\n

Last week, RL discovered an active Microsoft 365 device code phishing campaign that abuses Microsoft’s legitimate OAuth 2.0 Device Authorization Grant flow to obtain access to victim accounts.<\/p>\n

Rather than stealing passwords through a counterfeit login page, the phishing kit persuades victims to complete a legitimate Microsoft authentication process that authorizes an attacker-controlled device.<\/p>\n

In this companion Spectra Analyze in Action post, you’ll find a deep dive on how it works, including the phishing lure and attack workflow, code for the landing page, IOCs, and detection opportunities at RL Blog.<\/span><\/a><\/p>\n

YARA rule<\/h2>\n

The full-length blog, above, includes a YARA rule that can be used to detect phishing landing pages. <\/p>\n

\n
rule DeviceCode_Phishing_LandingPageHTML\n{\n    meta:\n        author = \"Malware Utkonos\"\n        date = \"2026-05-20\"\n        description = \"Detects Device Code phishing kit landing page HTML.\"\n    strings:\n        $login_akam = \"aka.ms\/devicelogin\"\n        $login_msft = \"microsoft.com\/devicelogin\"\n        $login_mso1 = \"login.microsoftonline.com\/common\/oauth2\/deviceauth\"\n        $login_mso2 = \"login.microsoftonline.com\/common\/oauth2\/v2.0\/deviceauth\"\n        $login_live = \"login.live.com\/oauth20_remoteconnect.srf\"\n        $login_link = \"microsoft.com\/link\"\n\n        $unicode_zws = { E2808B }\n        $unicode_zwnj = { E2808C }\n        $unicode_wj = { E281A0 }\n\n        $dc = \"\\\"dc=\"\n\n        $evosts = \"\\x15\\x15\\xd9\\xbd\\x4d\\xd1\\xcd\\x05\\xc9\\xd1\\xa5\\x99\\x85\\x8d\\xd1\\xcc\" base64(\"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_\")\n\n    condition:\n        any of ($login*) and\n        any of ($unicode*) and\n        $dc and $evosts and\n        filesize < 1MB\n}<\/code><\/pre>\n<\/div>\n
You can enable this rule in Spectra Analyze and run a retrohunt to identify any historic landing pages in either our own locally submitted files or the ReversingLabs file corpus. In Spectra Analyze, select the YARA option in the upper right corner. Then, select \u201cAdd Ruleset\u201d and \u201cCreate Ruleset\u201d from the drop down menu. Copy and paste the YARA rule above, and then save it, as shown below. You select the \u201cEnable Ruleset\u201d option on the upper left, as well as the \u201cRun Ruleset Continuously in Spectra Intelligence\u201d option if you want to match against any future submitted samples.<\/p>\n
\n