新型釣魚攻擊透過 OAuth 繞過 Microsoft 365 MFA

🔑 增強重點摘要

• •The phishing campaign targets North American businesses using OAuth 2.0 Device Authorization Grant, where attackers pre-register a malicious app and provide a device code for victims to enter on the legitimate microsoft.com/devicelogin page, bypassing MFA[1][2][3].
• •Phishing lures include fake emails about salary bonuses, electronic funds payments, or voicemails, directing victims to authorize the attacker's device, granting persistent access to Outlook, Teams, and OneDrive via stolen OAuth access and refresh tokens[1][2][3].
• •This technique does not rely on credential theft but exploits post-MFA token issuance, allowing attackers to poll the token endpoint for real-time hijacking of valid tokens[1][2].
• •Defenses include Microsoft 365 admins using enterprise app allowlists to restrict OAuth consents, monitoring for anomalous device code usage, and revoking suspicious tokens[1][2][3].
• •Similar OAuth abuse has been observed in campaigns by Pawn Storm since 2015 and device code vishing targeting Entra ID accounts in technology sectors[2][6].

🛠️ 技術深入

• •Attackers register an OAuth app in Microsoft 365 to obtain a client_id, then generate a unique device_code and user_code using open-source tools[1][6].
• •Victim is phished to enter the user_code on https://microsoft.com/devicelogin, completing MFA on the legitimate site, which triggers token issuance to the attacker's polling endpoint[1][2][3][6].
• •Attacker polls Microsoft's token endpoint (e.g., via device_code polling flow in OAuth 2.0 RFC 8628) to capture access_token and refresh_token for persistent, bearer-token access without further auth[1][2].
• •Tokens enable API calls to Microsoft Graph for M365 services; they act as bearer credentials, blending with normal integration traffic and evading MFA[2][3].
• •Distinct from AiTM phishing, which uses reverse proxies for session cookies; this is pure device flow abuse post-legitimate auth[1][4].

🔮 前景展望AI analysis grounded in cited sources

⏳ 時間線