{"id":"CMP-202611-6qqx6e","kind":"campaign","aliases":[],"related":[],"title":"Device-code phishing kit takes over Microsoft 365 accounts without ever showing a code: fake NDA emails send victims to the real Microsoft sign-in, which hands the attacker tokens, even with passkeys (KnowBe4)","description":null,"summary":"KnowBe4 Threat Lab found a device-code phishing kit in the wild (first seen August 2026) that hides the device code from the victim. A phishing email asks the reader to approve an NDA. It is sent through Mailchimp's Mandrill service, so it passes email authentication, and links go through Mandrill click tracking and several Cloudflare Workers hops over HTTP/3 (QUIC). The landing page checks for sandboxes, shows a fake 'Microsoft Defender' verification overlay and a 'Download Attachment' button, then sends the victim to a Microsoft-branded 'Verify your identity' page showing 'Document.pdf' that asks for an email address. The attacker's backend has already opened a Microsoft device-code sign-in for the Microsoft Authentication Broker app and placed that session's ctx/flowToken/canary values in the page. So the victim then signs in on the real login.microsoftonline.com with password and Authenticator push or Windows Hello, and that approves the attacker's device and hands them access and refresh tokens to Microsoft 365 mail and files. Passkeys and FIDO2 do not stop it because every step happens on Microsoft's real domain. Victims and targeted sectors: unknown.","severity":"high","cvss":null,"epss":null,"exploited":true,"exploited_at":"2026-11-12T16:15:38+00:00","products":[{"name":"Microsoft 365","fixed":[],"affected":"accounts allowing OAuth device code flow","ecosystem":"vendor"},{"name":"Microsoft Entra ID","fixed":[],"affected":"tenants allowing OAuth device code flow","ecosystem":"vendor"}],"ecosystems":[],"tags":["campaign","device-code","early-warning","microsoft-365","phishing"],"not_affected_if":[],"how_to_check":"- Lure: an email urgently asking you to approve/sign a non-disclosure agreement (NDA), sent through Mandrill (Mailchimp transactional) with Mandrill click-tracking links.\n- Links that pass through Cloudflare Workers (*.workers.dev) pages; known relay page: bandgdruback1[.]workers[.]dev/link/372b56d018b8cbc359b0819e402f11d5.\n- Page flow: fake 'Microsoft Defender' verification overlay, then a 'Download Attachment' button, then a Microsoft-branded 'Verify your identity' page showing 'Document.pdf' and asking for your email, then a real Microsoft sign-in.\n- In Entra ID sign-in logs: device code flow (authentication protocol deviceCode) sign-ins to Microsoft Authentication Broker that the user did not start from a device, especially shortly after a click on a workers.dev link.","fix":"- Block or restrict the device code flow with an Entra ID Conditional Access policy (authentication flows) for everyone who does not need it.\n- Review recent deviceCode sign-ins to Microsoft Authentication Broker; for suspicious ones revoke the user's sessions and refresh tokens and check mailbox rules and file access.\n- Warn users: a document or NDA link that ends in a Microsoft sign-in asking to approve a sign-in on another device is phishing, even if the page is really microsoft.com.\n- Block bandgdruback1[.]workers[.]dev and treat Mandrill-tracked links to workers.dev pages as suspicious.","status":"open","published_at":null,"first_seen_at":"2026-11-12T16:15:38+00:00","triaged_at":"2026-11-12T16:15:38+00:00","updated_at":"2026-11-12T16:17:30+00:00","category":"vendor","confidence":null,"triage":{"cause":{"at":"2026-11-12T16:16:22Z","path":"phishing","entry":"social-engineering","reason":"The victim is tricked by a fake NDA email and fake verification pages into signing in on the real Microsoft login, which approves the attacker's device code session and hands over tokens.","confidence":0.8}},"analyst_status":"done","analyst_note":null,"search":"'-202611':38A '-365':54B '-6':39A '2026':72B '365':9A,42A,223B 'access':217B 'account':10A 'address':157B 'alreadi':163B 'app':178B 'approv':88B,209B 'ask':84B,153B 'attach':135B 'attack':31A,159B,211B 'august':71B 'authent':103B,176B,202B 'backend':161B 'brand':145B 'broker':177B 'button':136B 'campaign':46B 'check':122B 'click':109B 'cloudflar':113B 'cmp':37A 'code':3A,15A,49B,63B,77B,169B 'ctx/flowtoken/canary':184B 'defend':129B 'devic':2A,48B,62B,76B,168B,213B 'device-cod':1A,47B,61B,167B 'document.pdf':151B 'domain':242B 'download':134B 'earli':51B 'early-warn':50B 'email':18A,83B,102B,156B 'entra':44A 'even':33A 'ever':12A 'everi':235B 'fake':16A,127B 'fido2':229B 'file':226B 'first':69B 'found':59B 'go':106B 'hand':29A,215B 'happen':237B 'hello':206B 'hide':74B 'hop':115B 'http/3':117B 'id':45A 'ident':148B 'kit':5A,65B 'knowbe4':36A,56B 'lab':58B 'land':120B 'link':105B 'login.microsoftonline.com':198B 'mail':224B 'mailchimp':95B 'mandril':97B,108B 'microsoft':8A,24A,41A,43A,53B,128B,144B,166B,175B,222B,239B 'microsoft-brand':143B 'nda':17A,90B 'open':164B 'overlay':131B 'page':121B,149B,188B 'pass':101B 'passkey':35A,227B 'password':200B 'phish':4A,55B,64B,82B 'place':180B 'push':203B 'qqx6e':40A 'quic':118B 'reader':86B 'real':23A,197B,241B 'refresh':219B 'sandbox':124B 'sector':246B 'seen':70B 'send':19A,138B 'sent':93B 'servic':98B 'session':182B 'sever':112B 'show':13A,125B,150B 'sign':26A,171B,193B 'sign-in':25A,170B 'step':236B 'stop':232B 'take':6A 'target':245B 'threat':57B 'token':32A,220B 'track':110B 'unknown':247B 'valu':185B 'verif':130B 'verifi':146B 'victim':20A,80B,140B,191B,243B 'warn':52B 'wild':68B 'window':205B 'without':11A 'worker':114B","nicknames":["Device Code Hidden Relay"],"mitigations":[],"who_affected":null,"tier":"A","verified":{},"analyst_revisit_at":null,"fix_status":null,"audience":null,"plain_action":null,"pkeys":["365","devicecodehiddenrelay","entraid","microsoft365","microsoftentraid"],"ptokens":["365","entra","id","microsoft"],"labels":["campaign","devicecode","earlywarning","high","microsoft365","phishing","vendor"],"campaign_type":"phishing","search_a":"'-202611':38A '-6':39A '365':9A,42A 'account':10A 'attack':31A 'cmp':37A 'code':3A,15A 'devic':2A 'device-cod':1A 'email':18A 'entra':44A 'even':33A 'ever':12A 'fake':16A 'hand':29A 'id':45A 'kit':5A 'knowbe4':36A 'microsoft':8A,24A,41A,43A 'nda':17A 'passkey':35A 'phish':4A 'qqx6e':40A 'real':23A 'send':19A 'show':13A 'sign':26A 'sign-in':25A 'take':6A 'token':32A 'victim':20A 'without':11A","search_b":"'-365':54B '2026':72B '365':223B 'access':217B 'address':157B 'alreadi':163B 'app':178B 'approv':88B,209B 'ask':84B,153B 'attach':135B 'attack':159B,211B 'august':71B 'authent':103B,176B,202B 'backend':161B 'brand':145B 'broker':177B 'button':136B 'campaign':46B 'check':122B 'click':109B 'cloudflar':113B 'code':49B,63B,77B,169B 'ctx/flowtoken/canary':184B 'defend':129B 'devic':48B,62B,76B,168B,213B 'device-cod':47B,61B,167B 'document.pdf':151B 'domain':242B 'download':134B 'earli':51B 'early-warn':50B 'email':83B,102B,156B 'everi':235B 'fake':127B 'fido2':229B 'file':226B 'first':69B 'found':59B 'go':106B 'hand':215B 'happen':237B 'hello':206B 'hide':74B 'hop':115B 'http/3':117B 'ident':148B 'kit':65B 'knowbe4':56B 'lab':58B 'land':120B 'link':105B 'login.microsoftonline.com':198B 'mail':224B 'mailchimp':95B 'mandril':97B,108B 'microsoft':53B,128B,144B,166B,175B,222B,239B 'microsoft-brand':143B 'nda':90B 'open':164B 'overlay':131B 'page':121B,149B,188B 'pass':101B 'passkey':227B 'password':200B 'phish':55B,64B,82B 'place':180B 'push':203B 'quic':118B 'reader':86B 'real':197B,241B 'refresh':219B 'sandbox':124B 'sector':246B 'seen':70B 'send':138B 'sent':93B 'servic':98B 'session':182B 'sever':112B 'show':125B,150B 'sign':171B,193B 'sign-in':170B 'step':236B 'stop':232B 'target':245B 'threat':57B 'token':220B 'track':110B 'unknown':247B 'valu':185B 'verif':130B 'verifi':146B 'victim':80B,140B,191B,243B 'warn':52B 'wild':68B 'window':205B 'worker':114B","search_c":"","cause_entry":"social-engineering","cause_path":"phishing","disclosures_checked_at":null,"first_public_at":"2026-11-12T16:04:01+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"analyst","external_id":"CMP-202611-6qqx6e","url":null,"severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-11-12T16:15:38+00:00","fetched_at":"2026-11-12T16:15:38+00:00","note":null}],"documents":[{"id":136208,"url":"https://blog.knowbe4.com/the-hidden-relay-inside-a-device-code-phishing-kit-that-never-shows-the-code","title":"KnowBe4: The Hidden Relay: Inside a Device Code Phishing Kit That Never Shows the Code","kind":"blog","source":"blog","publisher":null,"text":"The Hidden Relay: Inside a Device Code Phishing Kit That Never Shows the Code\n\nLead Analysts : Maddhav Grandy, Prabhakaran R and Jeewan Singh Jalal","published_at":"2026-11-12T16:04:01+00:00","relation":"describes","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}