TL;DR: Credential-harvesting campaigns are abusing Microsoft’s device code authentication flow through fake verification pages and malicious redirects, with state-linked operators throttling exposure to stay stealthy, according to Anomali’s coverage of Amazon’s disruption of the APT29 operation. The pattern shows that authentication trust paths, not just malware delivery, are now the primary abuse surface.
At a glance
What this is: This is a credential-harvesting campaign analysis showing how APT29 used watering-hole redirects and fake verification pages to abuse Microsoft device code authentication.
Why it matters: It matters because identity teams must treat authentication flows, redirect handling, and user approval prompts as attack surfaces, not just login convenience features.
Context
Device code flow is an authentication pattern that lets a user approve a login on one device after starting it on another. In this campaign, that trust path was turned into the entry point, with attackers using fake verification pages rather than direct malware installation to obtain access.
The governance gap is not only around phishing content. It is about how much trust the organisation places in a user’s momentary approval of a device and how little scrutiny is applied to where that approval request originated. For IAM and NHI programmes, that makes the authentication journey itself part of the control surface.
Amazon’s response shows this was a coordinated disruption rather than a single-site phishing page. The attackers reportedly limited exposure to around 10% of visitors, which is consistent with stealth-oriented credential harvesting rather than broad, noisy credential theft.
Key questions
Q: What breaks when attackers abuse device code authentication flows?
A: The assumption that a user approval step is inherently trustworthy breaks down. Attackers can present a fake verification page, capture the code or approval, and convert that moment into account access. The control failure is not just phishing awareness, but the lack of strong origin validation around the approval path and the session being authorized.
Q: Why does selective redirection make credential-harvesting campaigns harder to detect?
A: Selective redirection reduces noise, so only a small fraction of users encounter the malicious path. That keeps telemetry sparse, delays reporting, and makes the campaign look like a transient web issue rather than a coordinated identity attack. Teams need behavioural correlation across web and authentication logs, not just high-volume indicators.
Q: What are the signs that a watering-hole credential campaign is active?
A: Look for legitimate sites serving unexpected client-side scripts, unusual redirects to verification pages, and spikes in authentication activity that do not match user intent. If only a subset of visitors is affected, the campaign may be trying to stay below the threshold that triggers broad security attention.
Q: How should organisations respond when device approval is being used as a phishing vector?
A: They should treat the approval step as a sensitive control point, tighten user guidance, instrument the flow with logging and anomaly detection, and review whether the verification page or redirect chain can be spoofed. If the approval surface cannot be trusted, the authentication design is already too permissive.
Technical breakdown
How device code flow becomes a phishing target
Device code flow shifts part of authentication to a separate browser or device, which is useful for headless or constrained clients. The weakness is that the user is asked to trust an external approval page and enter or confirm a code without strong contextual proof that the request is legitimate. Attackers exploit that gap by imitating the verification experience and steering the victim into approving an attacker-controlled session. In effect, the protocol’s convenience becomes the lure. The control problem is not encryption or token strength alone, but whether the user can distinguish the real authorization path from a counterfeit one.
Practical implication: treat device code prompts as high-risk authentication events and require stronger origin validation around them.
Watering-hole redirects and malicious JavaScript in credential harvesting
A watering-hole campaign compromises legitimate sites that the target population already visits, then injects code that redirects a fraction of users to a malicious destination. In this case, the JavaScript silently sent about 10% of visitors to fake Cloudflare verification pages. That selective routing matters because it lowers detection pressure while preserving plausible site behaviour for most users. It also shows how web compromise and identity abuse can be chained together: the website delivers the lure, and the fake verification page captures the authentication event. The attack succeeds because the user believes the request sits inside a trusted browsing context.
Practical implication: monitor for unexpected client-side redirects and injected scripts on sites that sit in your user trust path.
Why throttled exposure improves operator stealth
Threat actors often limit how many users see the malicious content so security teams get fewer samples, fewer reports, and a smaller telemetry footprint. By throttling exposure, the campaign can stay alive longer and harvest credentials from selected targets without triggering the kind of noise that mass phishing produces. This is a trade-off between scale and dwell time. The article’s note that APT29 limited redirection to roughly 10% of visitors is consistent with that strategy. For defenders, low-volume abuse is harder to spot because it resembles routine web traffic until multiple signals are correlated.
Practical implication: use behavioural detection and web telemetry correlation, not volume alone, to find low-and-slow credential theft.
Threat narrative
Attacker objective: The attackers aimed to harvest valid account access by tricking users into authorizing attacker-controlled devices.
- Entry occurred through compromised legitimate websites that had malicious JavaScript injected into them.
- Credential harvesting followed when visitors were redirected to fake verification pages abusing Microsoft’s device code flow.
- Escalation happened as victims approved attacker-controlled devices, handing over account access the operators could reuse.
- Impact was broader account compromise with a stealth profile that allowed the campaign to persist while targeting selected visitors.
Breaches seen in the wild
- Microsoft Midnight Blizzard breach: Midnight Blizzard (APT29) exploited legacy test account without MFA to breach Microsoft.
- Anthropic GTG-1002 AI espionage campaign: A state-sponsored group ran Claude Code agents to attack about 30 organisations, harvesting and reusing credentials at machine speed.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
Authentication trust paths are now a primary abuse surface: This campaign did not depend on malware delivery alone. It succeeded by subverting the moment where a user decides a login request is legitimate, which makes the authentication journey itself part of the attack surface. For IAM teams, that means phishing resistance has to extend beyond passwords and toward the legitimacy of the approval path.
Throttled credential harvesting is a governance problem, not just an detection problem: Redirecting only a small share of visitors reduces noise and extends campaign life. That behaviour makes traditional volume-based controls less useful because the operation is designed to look sparse. Practitioners need to think in terms of user journey integrity and conditional trust, not just alert counts.
Device code flow needs explicit abuse assumptions: The flow was built for convenience across devices, but that convenience creates a trust leap when the approval page is spoofed. The right question is not whether the protocol works as designed, but whether the surrounding user validation model can survive adversarial redirection. The implication is that authentication design must account for counterfeit approval surfaces.
Named concept: approval-path phishing: This campaign illustrates a specific pattern where attackers target the user’s approval step instead of the password entry step. That matters because many control designs still assume the dangerous moment is credential entry, when in fact the approval decision can be the higher-risk event. Practitioners should treat approval-path compromise as a first-class identity threat.
Espionage tradecraft is diffusing into broader credential crime: The article notes that APT29 is best known for espionage, yet the same disciplined stealth is being applied in wider credential-harvesting operations. That shift raises the baseline for every organisation because the operator model, not just the target set, is changing. Security programmes should assume state-grade tradecraft can arrive through ordinary web trust flows.
What this signals
Approval-path phishing: The important shift here is that attackers are no longer waiting for a password to be mistyped. They are exploiting the user’s decision to approve a device, which means identity teams have to protect the approval moment as carefully as the login.
For practitioners, that creates a direct link between web security and IAM. A compromised website, a malicious redirect, and a counterfeit verification page can all converge on a single identity event, so detection has to span browser, web, and authentication telemetry.
Low-volume campaigns are especially dangerous because they can look like background noise until enough user journeys are stitched together. The operational response is to watch for trust-path anomalies, not just credential-theft spikes.
For practitioners
- Harden device code approval flows Add stronger verification around device code prompts, including user education on where approval pages originate and how legitimate flows should appear.
- Monitor for injected JavaScript and malicious redirects Review high-trust websites and externally facing properties for unexpected client-side redirection, script injection, and verification-page impersonation.
- Correlate low-volume web abuse signals Look for sparse but repeated redirect patterns, unusual verification-page visits, and authentication anomalies that would not stand out in bulk phishing telemetry.
- Treat approval events as privileged identity actions Classify device approval and similar consent moments as sensitive identity events that warrant logging, review, and anomaly detection across the authentication path.
Key takeaways
- This campaign shows that identity abuse can begin in the browser long before a password or token is captured.
- Selective redirection and fake verification pages make credential theft harder to see because the operator trades volume for stealth.
- The practical control gap is the approval path itself, which needs stronger validation, logging, and anomaly detection than many teams currently apply.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 and MITRE ATT&CK address the attack and risk surface, while NIST CSF 2.0 and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-04 — Insecure Authentication | The campaign abuses a device code authentication flow and counterfeit approval pages. |
| NHI-10 — Human Use of NHI | Victims are manipulated into approving attacker-controlled devices through a human decision point. | |
| Recommendation — Harden authentication journeys against spoofed approval surfaces and verify device code prompts. Reduce human approval reliance for sensitive NHI authentication events and add stronger validation. | ||
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | The attack turns an authorization moment into account compromise. |
| Recommendation — Review authorization paths so device approvals are logged, monitored, and tightly scoped. | ||
| MITRE ATT&CK | TA0006;TA0008 — Credential Access; Lateral Movement | The campaign’s objective is credential access, with reuse enabling broader account abuse. |
| Recommendation — Map device-code abuse to credential-access tradecraft and hunt for follow-on account reuse. | ||
| CIS Controls v8 | CIS-5 — Account Management | Compromised approvals hand attackers valid account access that must be governed. |
| Recommendation — Apply account management controls to detect and contain accounts approved through suspicious flows. | ||
Key terms
- Device Code Flow: A device code flow is an OAuth pattern for clients that cannot host a browser. The application gets a user code and polling credential, while the user completes login in a separate browser session. In CLI contexts, it shifts risk into token handling and session boundary control.
- Watering Hole Attack: A watering hole attack is a campaign in which attackers place malicious content where a target group expects trusted content, such as a product documentation page or community site. The goal is to convert normal browsing into malicious execution or credential capture without alarming the user.
- Credential Harvesting: Credential harvesting is the collection of secrets, tokens, keys, or certificates from a compromised workload. In container environments, it often targets file paths, environment variables, service account tokens, and metadata services because those locations frequently hold reusable identity material.
- Approval Phishing: A fraud technique that persuades a user to grant a malicious wallet or application permission instead of stealing a password or private key. The risk is delegated authority, which can persist until the user or platform revokes it and can be exploited to move assets without further interaction.
Deepen your knowledge
NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or NHI governance in your organisation, it is worth exploring.
Published by the NHIMG editorial team on August 2, 2026.
Updated on October 12, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org