Device-code phishing
Victim completes a device-code sign-in whose tokens land with the attacker
categoryIdentity, authentication and credential attacksseverityHighdetectabilityHighlabnot yet measured
Example: Storm-2372
Classification
36 values: 21 imported, 2 derived, 13 machine-classified. What do these mean?
Exploitability
| Attack vector | Credential attacks |
|---|---|
| Reach (CVSS) | |
| Attack complexity | Low |
| Privileges required | None |
| User interaction | Active |
| Attacker skill required | Low |
| Resources required | Low |
| Likelihood / prevalence | High |
| Maturity | Established |
Impact & scope
| Severity | High |
|---|---|
| Impact | Confidentiality |
| Platform | ContainersIaaSIdentity ProviderLinuxmacOSOffice SuiteSaaSWindows |
| Environment | Cloud |
| Target asset class | HumanIdentity |
| Kill-chain phase (tactic) | Credential AccessInitial Access |
Detection & telemetry
| Detectability | High |
|---|---|
| Testability | Atomic Red Team test |
| Data sources (ATT&CK data components) | Application Log ContentCloud Service EnumerationCloud Service ModificationCloud Storage AccessFile AccessFile CreationLogon Session CreationProcess CreationUser Account Authentication |
Detection & response
Mitigated by 52
- M1017 attack-mitigation
- M1018 attack-mitigation
- M1021 attack-mitigation
- M1031 attack-mitigation
- M1047 attack-mitigation
- M1049 attack-mitigation
- M1054 attack-mitigation
D3-ANCId3fendD3-APCAd3fendD3-CCSAd3fendD3-CFd3fendD3-CHd3fendD3-CMd3fendD3-CQd3fendD3-CRd3fendD3-CROd3fendD3-CSPPd3fendD3-CTSd3fendD3-DAd3fendD3-DFd3fendD3-DId3fendD3-DUCd3fendD3-EFd3fendD3-EFAd3fendD3-ERd3fendD3-FAd3fendD3-FEd3fendD3-FEVd3fendD3-FIMd3fendD3-HDd3fendD3-IAAd3fendD3-ISVAd3fendD3-ITFd3fendD3-LFPd3fendD3-MFAd3fendD3-NTCDd3fendD3-NTFd3fendD3-NTSAd3fendD3-PHDURAd3fendD3-PMADd3fend- … and 12 more in the database
Detected by 51
- DET0070 attack-detection-strategy
- DET0515 attack-detection-strategy
0055ad1f-be85-4798-83cf-a6da17c993b3sigma00d0b5ab-1f55-4120-8e83-487c0a7baf19sigma023394c4-29d5-46ab-92b8-6a534c6f447bsigma0248a7bc-8a9a-4cd8-a57e-3ae8e073a073sigma0adc67e0-a68f-4ffd-9c43-28905aad5d6asigma0e29e3a7-1ad8-40aa-b691-9f82ecd33d66sigma1ae64f96-72b6-48b3-ad3d-e71dff6c6398sigma1cdd9a09-06c9-4769-99ff-626e2b3991b8sigma24de4f3b-804c-4165-b442-5a06a2302c7esigma25cde13e-8e20-4c29-b949-4e795b76f16fsigma295a59c1-7b79-4b47-a930-df12c15fc9c2sigma2f9356ae-bf43-41b8-b858-4496d83b2acbsigma32b5db62-cb5f-4266-9639-0fa48376ac00sigma3569aefd-e535-4391-8c18-24bd01a21eafsigma38e7f511-3f74-41d4-836e-f57dfa18eeadsigma4358e5a5-7542-4dcb-b9f3-87667371839bsigma4c55738d-72d8-490e-a2db-7969654e375fsigma52cad028-0ff0-4854-8f67-d25dfcbc78b4sigma538c5851-8c03-4724-8ec4-623bc7aadaeasigma53acd925-2003-440d-a1f3-71a5253fe237sigma571498c8-908e-40b4-910b-d2369159a3dasigma6555754e-5e7f-4a67-ad1c-4041c413a007sigma65744385-8541-44a6-8630-ffc824d7d4ccsigma678eb5f4-8597-4be6-8be7-905e4234b53asigma6d3a3952-6530-44a3-8554-cf17c116c615sigma6e4dcdd1-e48b-42f7-b2d8-3b413fc58cb4sigma7091372f-623c-4293-bc37-20c32b3492besigma864403a1-36c9-40a2-a982-4c9a45f7d833sigma8a4519e8-e64a-40b6-ae85-ba8ad2177559sigma91174a41-dc8f-401b-be89-7bfc140612a0sigma932ac737-33ca-4afd-9869-0d48b391fcc9sigma9b2cc4c4-2ad4-416d-8e8e-ee6aa6f5035asigmaa018fdc3-46a3-44e5-9afb-2cd4af1d4b39sigmaa6355fbe-f36f-45d8-8efc-ab42465cbc52sigmaa84fc3b1-c9ce-4125-8e74-bdcdb24021f1sigmaad7085ac-92e4-4b76-8ce2-276d2c0e68efsigmab1c50487-1967-4315-a026-6491686d860esigmab5de2919-b74a-4805-91a7-5049accbaefesigma- … and 11 more in the database
Tested by 5
114ccff9-ae6d-4547-9ead-4cd69f687306atomic67aaf4cb-54ce-42e2-ab56-e0a9bcc089b1atomic9a5352e4-56e5-45c2-9b3f-41a46d3b3a43atomicbc177ef9-6a12-4ebc-a2ec-d41e19c2791datomiccbb6799a-425c-4f83-9194-5447a909d67fatomic
Attack relationships
- Child: Angler phishing
- Child: Browser-in-the-browser (BitB)
- Child: Callback phishing (TOAD)
- Child: Clone phishing
- Child: Fake job / recruiter lure
- Child: Malspam
- Child: Phishing-as-a-service (PhaaS)
- Child: Spear phishing
- Child: Spear phishing via service
- Child: Vishing
Framework references
- Primary source: https://www.microsoft.com/en-us/security/blog/2025/02/13/storm-2372-conducts-device-code-phishing-campaign/
- attack: T1528 (primary)
- attack: T1566
Evidence & sources
- ev-0001 (Cyber Attack Taxonomy) — Name, definition and Example/ID taken verbatim from the 'Identity, authentication and credential attacks' table, line 353 of Cyber-Attack-Taxonomy.md
- ev-0002 (Seeded-record enrichment run 2026-09-30 (crosswalk + facet classification)) — Crosswalk to attack:T1528, attack:T1566 as the nearest framework entries; ids verified to exist in the cached catalogues.
- ev-0003 (MITRE Enterprise ATT&CK v19.2 (STIX 2.1)) — ATT&CK usage prevalence: 11 groups/software/campaigns reference this technique (ATT&CK enterprise v19.2)
- ev-0004 (MITRE Enterprise ATT&CK v19.2 (STIX 2.1)) — ATT&CK usage prevalence: 13 groups/software/campaigns reference this technique (ATT&CK enterprise v19.2)