tag: Token-Theft · 4 items
- Engineer — Plan: Public PoC exists on GitHub but EPSS is 0.01 and not KEV-listed, so no active exploitation pressure yet. Push Authenticator for Android version 6.2606.4246 via MDM to all enrolled devices and verify compliance through your endpoint management console.
- SOC/IR — Learn: The technique — a permissionless Android app impersonating a trusted Microsoft app to harvest Entra/work tokens — is worth understanding for future detection work (e.g., anomalous sign-in source patterns in Entra logs), but no IOCs or active campaign have been reported.
- Leader — Skip
- Signals: CVE-2026-80097 — CISA KEV: not listed, EPSS 0.01, public PoC on GitHub
- Engineer — Plan: Device code phishing industrialization is a signal to audit whether OAuth device code flow is enabled in your Entra ID / identity provider — restrict it to only necessary clients and enforce conditional access policies that block token reuse from unexpected locations.
- SOC/IR — Act: EvilTokens was actively stealing tokens at scale via device code flow; hunt for anomalous device code authentication requests in your identity logs (Entra Sign-in logs, unified audit log) since at least early 2026, and tune detections for device code grants issued to unfamiliar device types or followed by token use from new geographies.
- Leader — Learn: The Microsoft DCU-led disruption illustrates how AI-assisted PhaaS platforms are lowering the bar for credential and token theft campaigns; useful context for the next board or risk-committee briefing on evolving phishing sophistication.
- Engineer — Plan: PhaaS platforms like EvilTokens typically use AiTM techniques that bypass standard MFA; audit Microsoft 365 Conditional Access policies and prioritize rollout of phishing-resistant MFA (FIDO2/passkeys) to eliminate token-theft risk across your tenant.
- SOC/IR — Act: Platform disruption does not remediate already-compromised sessions; hunt for anomalous OAuth token grants, impossible-travel sign-ins, and legacy authentication usage in your Microsoft 365 environment covering the campaign’s active window.
- Leader — Act: With 10,000+ organizations affected, confirm this week whether your organization received a Microsoft DCU breach notification and verify your Microsoft 365 tenants were not among the 12,000 compromised accounts; brief leadership before they encounter the story externally.
- Engineer — Plan: Device code flow phishing is a real and growing vector for M365/Azure tenants; audit Conditional Access policies to block or restrict device code flow for user accounts that don’t require it, and enforce compliant-device requirements where the flow must remain enabled.
- SOC/IR — Plan: Build or tune detections on Entra ID sign-in logs for device code authorization events originating from unexpected locations or apps; also hunt for refresh token reuse anomalies that may indicate post-phishing lateral movement within M365.
- Leader — Learn: A named actor targeting US M365 tenants via Microsoft’s own authentication UI is useful context for the risk register and customer security questionnaire responses, but no confirmed breaches or near-term regulatory deadlines make this a monitor-and-track item rather than an executive action.