Credential-harvesting campaigns are exploiting device code flow

At a glance

What this is: This is an analysis of recent credential-harvesting campaigns that abuse device code authentication and redirect users through fake verification pages to capture account access.

Why it matters: It matters because identity teams have to account for abuse of legitimate authentication flows, not only password theft, when they design controls for human, NHI, and delegated access.

👉 Read Anomali's Cyber Watch coverage of APT29, Grok AI abuse, and more

Context

Device code phishing is a form of identity abuse where attackers trick users into approving a login they did not initiate. In this case, the campaign leveraged fake Cloudflare verification pages and malicious redirects to capture account access through Microsoft’s device code flow, which makes the trust boundary the real target.

For IAM teams, the important shift is that the abuse sits inside a legitimate authentication journey. That means conditional access, session monitoring, device trust, and user verification need to be evaluated as a chain, not as isolated controls. The fact that the campaign was throttled to about 10% of visitors also shows deliberate stealth rather than noisy opportunism.

The article’s starting point is typical of modern identity attacks: valid protocols are being repurposed to create attacker-controlled approval paths. That makes the issue relevant well beyond the specific operation described here.

Key questions

Q: How should security teams reduce device code phishing risk in Microsoft 365 environments?

A: Security teams should limit device-code authentication to approved use cases, pair it with compliant-device requirements, and add sign-in detections for unusual polling, consent, and post-login mailbox activity. User education still matters, but it cannot be the primary control because the login happens on a trusted portal. Stronger conditional access and session monitoring are the practical controls.

Q: Why do legitimate login flows become high-risk when attackers control the page?

A: Because the user is no longer judging whether the credentials are real, they are judging whether the page is. If the page looks trusted enough, the approval step can be redirected toward the attacker’s session. That is why authentication design must assume the interface can be imitated and the approval path can be hijacked.

Q: What breaks when teams only look for high-volume phishing activity?

A: Low-volume campaigns that target a small share of visitors can stay hidden long enough to harvest credentials or approvals. Volume-based detection misses these operations because the attacker is optimizing for secrecy, not scale. Teams need telemetry that spots unusual redirects, compromised websites, and sign-in anomalies even when overall traffic stays low.

Q: Who is accountable when a user approves a malicious authentication request?

A: Accountability sits with the organisation’s identity governance, not only with the individual user. If the process depends on user judgement under stress, the architecture has already accepted a fragile control point. Frameworks such as the NIST Cybersecurity Framework and Zero Trust architecture expect stronger verification than a single coerced approval.

Technical breakdown

How device code phishing turns legitimate login flows into access theft

Device code authentication is designed to let a user start a login on one device and complete approval on another. Attackers exploit that sequence by presenting a convincing verification page, then steering the victim into entering or approving a code that links the attacker’s session to the victim’s identity. The protocol itself is legitimate, but the user’s trust in the page and the timing of the approval become the weakness. This is why phishing resistance is not just about blocking fake passwords. It is about preventing attacker-controlled initiation of a trusted login path.

Practical implication: treat device code authentication as a high-risk flow that needs tighter user verification and conditional access.

Why throttled redirects make credential-harvesting campaigns harder to detect

A campaign that redirects only a small share of visitors is optimized for dwell time, not volume. By limiting exposure, operators reduce the chance that defenders, security scanners, or platform abuse systems see enough repetitions to identify the pattern quickly. That matters because identity attacks often rely on frictionless first contact and then rapid conversion into approved access. The use of legitimate websites as the initial host also gives the operation a credibility boost before the victim ever reaches the fake verification page.

Practical implication: monitor low-volume, high-trust redirect chains rather than relying only on bulk phishing indicators.

How cloud infrastructure and identity events intersect during abuse campaigns

The campaign’s use of EC2 infrastructure shows that the operational layer and the identity layer are tightly coupled. Once attackers can host, redirect, and terminate infrastructure quickly, they can preserve the identity lure long enough to collect approvals or tokens. The result is a blended attack pattern in which infrastructure abuse supports identity compromise, and the identity compromise then sustains access. For defenders, that means logs from web hosting, redirect behavior, and authentication events need to be correlated to understand the full chain.

Practical implication: correlate cloud hosting telemetry with authentication logs to spot identity abuse that begins as infrastructure misuse.

Threat narrative

Attacker objective: The objective is to convert a trusted authentication workflow into unauthorized account access that can support espionage and additional identity abuse.

1. Entry occurs when attackers compromise legitimate websites and inject malicious JavaScript that redirects selected visitors to a fake verification page.
2. Credential access occurs when the victim is tricked into completing Microsoft’s device code flow, linking the attacker to the approved account session.
3. Impact occurs when the attacker gains account access that can be used for follow-on espionage, lateral movement, or broader credential harvesting.

Breaches seen in the wild

• 230M AWS environment compromise — 230M AWS environments compromised via exposed .env files with cloud credentials.
• MITRE ATT&CK Enterprise Matrix — MITRE ATT&CK Enterprise — adversary tactics and techniques, threat detection, attack chain mapping, credential access, lateral movement, privilege escalation.

Read our 52 NHI Breaches Analysis report for a comprehensive view of breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Device code phishing is an identity control failure, not just a phishing variant. The campaign succeeds because the authentication step is treated as trustworthy once a user sees a familiar vendor-branded flow. That assumption collapses when attackers control the page, the redirect, and the timing of approval. Practitioners need to treat the login journey itself as an attack surface, not only the credentials entered into it.

Stealthy, throttled campaigns are a governance problem because they evade volume-based detection. Redirecting only a small percentage of traffic reduces operational noise and extends campaign lifetime. That means detection logic built around spikes, bulk spam, or obvious malicious hosting will miss important identity abuse patterns. Teams should assume that low-and-slow credential-harvesting operations are now a standard adversary choice.

Named concept: approval-path hijacking. This is the abuse of a legitimate user approval sequence to bind an attacker session to a valid identity. The phrase matters because it separates this pattern from classic password theft and from generic MFA fatigue attacks. The practitioner takeaway is that approval paths need governance on their own, especially where device codes, delegated login, or out-of-band verification are involved.

Cross-domain correlation is now essential for identity defense. The article links website compromise, cloud infrastructure, and authentication abuse into one chain. That is exactly why IAM, cloud security, and threat detection cannot operate as separate functions when identity is the target. The programmatic implication is to build one investigation path across hosting, redirect, and sign-in telemetry.

Espionage tradecraft is increasingly reusable at scale. APT29 is historically associated with targeted operations, yet the same techniques are being applied to broader credential-harvesting activity. That widens the attack surface for organisations that previously assumed they were too small or too ordinary to be in scope. Identity programmes should therefore be sized for technique reuse, not just named actors.

From our research:

• Only 19.6% of security professionals express strong confidence in their organisation's ability to securely manage non-human workload identities, according to the 2024 Non-Human Identity Security Report.
• 23.7% of organisations share secrets through insecure methods such as email or messaging applications, which shows how easily identity trust can still be weakened by operational shortcuts.
• For related guidance, see Ultimate Guide to NHIs , Static vs Dynamic Secrets for the access model decisions that reduce long-lived credential exposure.

What this signals

Approval-path hijacking will keep expanding wherever organisations rely on user-mediated trust decisions inside authentication flows. Device code, delegated login, and out-of-band verification are all useful patterns, but they become brittle if the surrounding programme cannot distinguish a legitimate request from an attacker-controlled initiation. That is a governance issue, not just a product setting.

The practical signal for IAM teams is that identity telemetry must become more behavioral. Correlating redirect chains, sign-in anomalies, and infrastructure changes will matter more than chasing isolated alerts, especially when adversaries deliberately keep campaigns small to avoid detection.

The fact that modern credential-harvesting techniques are now borrowed from espionage playbooks means programme maturity will be judged by response speed and approval-path visibility, not by password policy strength alone.

For practitioners

• Harden device code authentication flows Restrict device code approval to managed devices, enforce stronger conditional access, and require additional verification when the login originates from an untrusted browser context.
• Detect low-volume redirect abuse Instrument web and DNS telemetry to flag compromised sites that send only a fraction of visitors to verification pages, especially when redirect destinations change quickly.
• Correlate identity and cloud hosting logs Join sign-in events, token issuance, and cloud infrastructure changes so investigators can trace a fake verification page back to the account compromise and hosting node.
• Review user-facing approval prompts Make approval screens explicit about device, origin, and risk context so users can recognise when a login request does not match their own action.

Key takeaways

• The article shows that attackers can turn a legitimate device code flow into account takeover by controlling the approval path, not by breaking the protocol.
• The campaign’s low-volume, selective redirection strategy is designed to avoid detection, which makes identity telemetry and cross-domain correlation more important than bulk phishing indicators.
• IAM teams should treat user approval journeys as governable attack surfaces and tighten device trust, conditional access, and sign-in monitoring accordingly.

Key terms

• Device Code Authentication: A login flow that lets a user authenticate on one device by approving a code from another device or browser. It is convenient for constrained environments, but it also creates a high-value approval step that attackers can exploit if they can fake the prompt or redirect the user.
• Approval-path Hijacking: The abuse of a legitimate user approval sequence so an attacker can bind their session to a valid identity. In practice, the attacker does not need to steal a password if they can control the page, timing, or context that leads the user to approve access.
• Low-and-slow Credential Harvesting: A campaign style that limits volume to reduce detection and extend dwell time. Instead of blasting many targets, attackers selectively expose only a fraction of traffic, which makes the operation harder to spot with tools tuned for noisy phishing or bulk abuse.

What's in the full analysis

Anomali's full post covers the operational detail this analysis intentionally leaves for the source:

• MITRE ATT&CK mappings for each campaign, including the exact tactics used across phishing, obfuscation, and credential access
• Campaign-by-campaign summaries of APT29, APT37, Silver Fox, and other activity covered in the post
• Indicator-style details on malicious infrastructure, redirect behavior, and malware delivery chains
• The full analyst commentary that ties each observed tactic to broader defensive implications

👉 Anomali's full Cyber Watch post includes the individual campaign summaries and ATT&CK mappings behind each incident.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or NHI governance in your organisation, it is worth exploring.