Skip to content

17. Initial Access Evolution

17.1 New MFA Bypass Techniques (Including FIDO Bypass)

Device Code Phishing: the ultimate method for bypassing all MFA including FIDO

This is the most disruptive initial access technique of 2025-2026. The user completes authentication on a genuine Microsoft/Google page, MFA triggers normally, but the token is handed to the attacker.

Attack Principle (OAuth Device Authorization Grant Abuse): 

OAuth Device Code Flow's original intent: designed for input-constrained devices (smart TVs / CLI tools)
  → the user visits microsoft.com/devicelogin on another device → enters the short code → completes authentication → the original device receives the token

Attacker abuse:
  1. The attacker starts the Device Code Flow (calling the Microsoft API) → obtains device_code + user_code
  2. Lure the victim to visit microsoft.com/devicelogin → enter the user_code
  3. The victim completes authentication on the genuine Microsoft login page (including MFA/FIDO)
  4. The attacker polls the token endpoint → obtains Access Token + Refresh Token
  5. The victim is redirected to a legitimate placeholder page (DocuSign/Google/Microsoft) → none the wiser

Why It Bypasses FIDO (2025.04 breakthrough discovery by Dennis Kniep): - FIDO's design assumption: the user only uses the security key in an authentication session they initiated → a phishing site cannot forge the legitimate domain → FIDO binds the origin - The Device Code flaw: the user completes authentication on the genuine Microsoft page → the FIDO security key sees a legitimate origin → verification completes normally - The problem is not authentication itself, but "what got authorized": the user thinks they are authorizing their own device, but they are actually authorizing the attacker's session

EvilTokens PhaaS (large-scale attack campaign disclosed by Microsoft in 2026.04): - AI-enhanced: LLM generates hyper-personalized emails (RFP/invoice/manufacturing workflow themes) - Dynamic code generation: traditional attacks embed a pre-generated code in the email → it expires after 15 minutes. The new method only starts the flow when the user clicks the link → no expiration problem - Automated fill-in: a headless browser automatically fills the generated code into microsoft.com/devicelogin in the background → the user only needs to click the link → auto-redirect to the authentication page → no manual code entry - Uses the Intune Company Portal ClientID: can bypass the Intune compliant-device Conditional Access policy

Post-Exploitation (After Obtaining the Token): 

Access Token → access M365 (email/SharePoint/Teams)
Refresh Token → long-lived (90 days) → persistent access
→ register a new device to Entra ID → obtain a PRT (Primary Refresh Token)
→ PRT enables SSO across the entire M365 environment → move laterally to all cloud resources
→ ⚠ Resetting the password does NOT revoke the Refresh Token! You must explicitly revoke all sessions and tokens

Practical Tools: DeviceCodePhishing automates the entire flow

Defense: - Disable the Device Authorization Grant Flow in Entra ID Conditional Access (most effective) - The "Client App Condition" must include "Other clients" and block them - Monitor authenticationProtocol=deviceCode events in sign-in logs - Incident response: do not just reset the password → must revoke all Refresh Tokens and active sessions → check for newly registered devices

Token Theft

Entra ID PRT Theft: obtain the Primary Refresh Token → Pass-the-PRT → access the entire M365 without a password or MFA - Tools: ROADtools / AADInternals

OAuth Token Theft: steal the Access Token/Refresh Token of an authenticated session → Refresh Tokens remain usable long-term (90+ days) - Check: whether there are abnormal OAuth app authorizations / new device registrations

MFA Fatigue Attack Upgrade

  • Continuously push MFA prompts until the user, fatigued, clicks approve
  • New variant: AI simulates legitimate request patterns / spaces out timing to avoid triggering rate limits

Evilginx Evolution

  • Man-in-the-middle proxy → steal session cookies → bypass MFA
  • Supports phishlets for more SaaS applications
  • Compared with Device Code: Evilginx requires a forged domain (detectable), Device Code operates on the genuine domain (more covert)

17.2 QR Code Phishing (Quishing)

  • Encode the phishing URL into a QR code → send in email / social media
  • Advantages: security gateways do not scan QR code content / mobile-side protections are weaker
  • Combine with AI-generated contextual QR codes (parking payment / parcel pickup / meeting room sign-in)