Topic starter
02/08/2026 12:27 pm
TL;DR: Credential-harvesting campaigns are abusing Microsoft’s device code authentication flow through fake verification pages and malicious redirects, with state-linked operators throttling exposure to stay stealthy, according to Anomali’s coverage of Amazon’s disruption of the APT29 operation. The pattern shows that authentication trust paths, not just malware delivery, are now the primary abuse surface.
Editorial analysis by NHI Mgmt Group, based on content published by Anomali: “Anomali Cyber Watch: APT 29, APT37, Silver Fox, Grok AI Exploits, and More”.
Key questions
Q: What breaks when attackers abuse device code authentication flows?
A: The assumption that a user approval step is inherently trustworthy breaks down.
Q: Why does selective redirection make credential-harvesting campaigns harder to detect?
A: Selective redirection reduces noise, so only a small fraction of users encounter the malicious path.
Q: What are the signs that a watering-hole credential campaign is active?
A: Look for legitimate sites serving unexpected client-side scripts, unusual redirects to verification pages, and spikes in authentication activity that do not match user intent.
Practitioner guidance
- Harden device code approval flows Add stronger verification around device code prompts, including user education on where approval pages originate and how legitimate flows should appear.
- Monitor for injected JavaScript and malicious redirects Review high-trust websites and externally facing properties for unexpected client-side redirection, script injection, and verification-page impersonation.
- Correlate low-volume web abuse signals Look for sparse but repeated redirect patterns, unusual verification-page visits, and authentication anomalies that would not stand out in bulk phishing telemetry.
Bottom line: This campaign shows that identity abuse can begin in the browser long before a password or token is captured.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
02/08/2026 1:25 pm
Authentication trust paths are now a primary abuse surface: This campaign did not depend on malware delivery alone. It succeeded by subverting the moment where a user decides a login request is legitimate, which makes the authentication journey itself part of the attack surface. For IAM teams, that means phishing resistance has to extend beyond passwords and toward the legitimacy of the approval path.
A question worth separating out:
Q: How should organisations respond when device approval is being used as a phishing vector?
A: They should treat the approval step as a sensitive control point, tighten user guidance, instrument the flow with logging and anomaly detection, and review whether the verification page or redirect chain can be spoofed. If the approval surface cannot be trusted, the authentication design is already too permissive.
👉 Read our full editorial: Credential-harvesting campaigns are exploiting device code flow