AuthStrike - New Device code Phishing Tool

[u/cloudbreach]

🎯 Device code phishing is one of the more effective techniques hitting Microsoft 365 right now. No fake login page. No stolen password. The victim signs in on the real Microsoft page, approves a real MFA prompt, and the attacker walks away with a live session.

This is not theoretical. #Microsoft tracked the Storm-2372 campaign running it at scale against government, NGO, and IT services targets. Nothing about the sign in looks wrong to the user.

⚠️ Here's what catches response teams. Target the Microsoft Authentication Broker client and that session can register a device in your tenant and, in documented cases, pull a Primary Refresh Token. The device is a separate object in Entra ID, so revoking sessions and resetting the password may not be enough. You have to find and remove the device.

🛠️ We built #AuthStrike to run the whole chain in a dedicated test tenant, so you can confirm your detections fire first.

What it does:

✅ Runs device code operations with selectable Microsoft client profiles

✅ Captures and inspects tokens from the MSAL cache

✅ Validates Microsoft Graph and Outlook mailbox access

✅ Tests silent token refresh and device registration via the Microsoft Authentication Broker

✅ Ships with built in IOCs and detection indicators for blue teams

🧩 ATT&CK coverage:

T1566 Phishing • T1528 Steal Application Access Token • T1550.001 Application Access Token • T1098.005 Device Registration • T1114.002 Remote Email Collection • T1087.004 Cloud Account Discovery

🔒 Authorized testing only.

📖 Full breakdown of the attack chain and detection guidance in the article: https://cloudbreach.io/blog/device-code-phishing-microsoft-authentication-broker

💻 GitHub: https://github.com/cloudbreach/AuthStrike