Storm-2372 'Device code phishing' attack

The group uses a technique called device code phishing, tricking victims into signing up to fake login pages, stealing their authentication tokens. This enables attackers to gain access to their accounts and data, and even make lateral movements within networks.

Recently, Microsoft adopted that the group is now also abusing the Microsoft Authentication Broker to refine their attack techniques and maintain longer-term access.

How does device code phishing work?

It is a way to extract your access token and abuse it afterwards.

What is VanRoey doing to prevent this in your area?

Customers who use our Managed Microsoft 365 services enjoy are already extra well protected anyway thanks to the strict policies we enforce. For example, we restrict who can add devices to Entra ID and limit the validity of sessions. But we are also taking additional measures:

• We are pushing an additional Conditional Access policy to all Managed customers to prevent this attack.
• We also strongly recommend the User Awareness (KnowBe4) training to prevent phishing in its broadest sense

What can you do yourself to prevent this?

To prevent this threat, it is initially crucial to make users aware of phishing techniques and suspicious login requests by using a 'Security Awareness campaign‘.

Organisations can mitigate the risk by reducing the device code authentication flow eliminate where possible and a strict Conditional access policy set up. It also recommends making multifactor authentication (MFA) mandatory and giving preference to phishing-resistant methods such as FIDO tokens or Microsoft Authenticator with passkeys. Also blocking legacy authentication and regular monitoring of suspicious login activity can help detect attacks early.