Teams booking flow used to hide Microsoft device code phishing
Original title: Crafty Microsoft Teams Booking Flow Disguises Device Code Phishing
A mid-October spearphish against a construction firm copied a device code when the target confirmed a fake meeting.
Huntress says a mid-October attack against a construction company used a spear-phishing email that impersonated a senior vice president at another construction firm via a typosquatted domain. Redirects through Microsoft Safe Links and a Google short link led to a fake Microsoft Teams meeting scheduler. Confirming the meeting copied a device code to the clipboard and opened Microsoft’s real device-login page, which would authorize the attacker’s session. Huntress says its SOC contained the incident.
- The lure impersonated a real executive and used a typosquatted construction-company domain.
- Redirects included a Microsoft Safe Links wrapper and a share.google short link.
- The site started a Microsoft device-code sign-in and returned a user code.
- Submitting the code on microsoft.com/devicelogin would authorize the attacker’s session.
- Huntress notified the impersonated company about the fake domain.
Impact: Attacker obtains Microsoft access tokens via device-code consent
- 1.Watch for Teams meeting-scheduler lures that copy a code before opening microsoft.com/devicelogin.
- Vendors
- Microsoft
- Products
- Microsoft TeamsMicrosoft 365
- Organizations
- Huntress
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | calendly.com | complete" note and redirecting the top window to hxxps[:]//calendly[.]com/[REDACTED]/30min. This redirects the victim to what looks |
| domain | gpimmlgration.com | backend in a request that carries no body: POST hxxps[:]//gpimmlgration[.]com/static-export/api/device/start X-Antibot-Token: REDACTED |
| domain | railway.com | traffic. References Riding the Rails: Threat Actors Abuse Railway.com PaaS as Microsoft 365 Token Attack Infrastructure: https:// |
| domain | share.google | otection.outlook[.]com) and pointed to a Google short link (share[.]google/?q=UltJkMsVWI5V 9GJM1). This then redirected to www.googl |
| domain | www.google.com | M1 Google short-link redirect used in the phishing chain. www[.]google[.]com/share[.]google?q=UltJkMsVWI5V9GJM1 Subsequent redirect |
| url | https://calendly.com/[REDACTED | rification complete" note and redirecting the top window to hxxps[:]//calendly[.]com/[REDACTED]/30min. This redirects the victim to what looks like a |
| url | https://gpimmlgration.com/static-export | oks). Those hooks route the kit's API calls to the backend (hxxps[:]//gpimmlgration[.]com/static-export). To an email scanner or crawler that doesn't run JavaS |
| url | https://gpimmlgration.com/static-export/api/device/start | it to the backend in a request that carries no body: POST hxxps[:]//gpimmlgration[.]com/static-export/api/device/start X-Antibot-Token: REDACTED X-Auth-Mode: cookie X-WinHell |
From the original article
12 min read at huntress.comThreat actors used a convincing Microsoft Teams meeting-booking lure to conceal device code phishing and trick victims into authorizing attacker access.
huntress.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.