Device Code Hidden Relay: Device-code phishing kit takes over Microsoft 365 accounts without ever showing a code: fake NDA emails send victims to the real Microsoft sign-in, which hands the attacker tokens, even with passkeys (KnowBe4)

KnowBe4 Threat Lab found a device-code phishing kit in the wild (first seen August 2026) that hides the device code from the victim. A phishing email asks the reader to approve an NDA. It is sent through Mailchimp's Mandrill service, so it passes email authentication, and links go through Mandrill click tracking and several Cloudflare Workers hops over HTTP/3 (QUIC). The landing page checks for sandboxes, shows a fake 'Microsoft Defender' verification overlay and a 'Download Attachment' button, then sends the victim to a Microsoft-branded 'Verify your identity' page showing 'Document.pdf' that asks for an email address. The attacker's backend has already opened a Microsoft device-code sign-in for the Microsoft Authentication Broker app and placed that session's ctx/flowToken/canary values in the page. So the victim then signs in on the real login.microsoftonline.com with password and Authenticator push or Windows Hello, and that approves the attacker's device and hands them access and refresh tokens to Microsoft 365 mail and files. Passkeys and FIDO2 do not stop it because every step happens on Microsoft's real domain. Victims and targeted sectors: unknown.