Notifications
Clear all
Topic starter
02/08/2026 12:27 pm
TL;DR: Credential-harvesting campaigns are abusing Microsoft’s device code authentication flow through fake verification pages and malicious redirects, with state-linked operators throttling exposure to stay stealthy, according to Anomali’s coverage of Amazon’s disruption of the APT29 operation. The pattern shows that authentication trust paths, not just malware delivery, are now the primary abuse surface.
NHIMG editorial — based on content published by Anomali: Anomali Cyber Watch covering APT 29, APT37, Silver Fox, Grok AI exploits, and more
Questions worth separating out
Q: How should security teams reduce device code phishing risk in Microsoft 365 environments?
A: Security teams should limit device-code authentication to approved use cases, pair it with compliant-device requirements, and add sign-in detections for unusual polling, consent, and post-login mailbox activity.
Q: Why do legitimate login flows become high-risk when attackers control the page?
A: Because the user is no longer judging whether the credentials are real, they are judging whether the page is.
Q: What breaks when teams only look for high-volume phishing activity?
A: Low-volume campaigns that target a small share of visitors can stay hidden long enough to harvest credentials or approvals.
Practitioner guidance
- Harden device code authentication flows Restrict device code approval to managed devices, enforce stronger conditional access, and require additional verification when the login originates from an untrusted browser context.
- Detect low-volume redirect abuse Instrument web and DNS telemetry to flag compromised sites that send only a fraction of visitors to verification pages, especially when redirect destinations change quickly.
- Correlate identity and cloud hosting logs Join sign-in events, token issuance, and cloud infrastructure changes so investigators can trace a fake verification page back to the account compromise and hosting node.
What's in the full analysis
Anomali's full post covers the operational detail this analysis intentionally leaves for the source:
- MITRE ATT&CK mappings for each campaign, including the exact tactics used across phishing, obfuscation, and credential access
- Campaign-by-campaign summaries of APT29, APT37, Silver Fox, and other activity covered in the post
- Indicator-style details on malicious infrastructure, redirect behavior, and malware delivery chains
- The full analyst commentary that ties each observed tactic to broader defensive implications
👉 Read Anomali's Cyber Watch coverage of APT29, Grok AI abuse, and more →
Device code phishing and credential harvesting , are controls keeping up?
Explore further
02/08/2026 1:25 pm
Device code phishing is an identity control failure, not just a phishing variant. The campaign succeeds because the authentication step is treated as trustworthy once a user sees a familiar vendor-branded flow. That assumption collapses when attackers control the page, the redirect, and the timing of approval. Practitioners need to treat the login journey itself as an attack surface, not only the credentials entered into it.
A few things that frame the scale:
- Only 19.6% of security professionals express strong confidence in their organisation's ability to securely manage non-human workload identities, according to the 2024 Non-Human Identity Security Report.
- 23.7% of organisations share secrets through insecure methods such as email or messaging applications, which shows how easily identity trust can still be weakened by operational shortcuts.
A question worth separating out:
Q: Who is accountable when a user approves a malicious authentication request?
A: Accountability sits with the organisation’s identity governance, not only with the individual user. If the process depends on user judgement under stress, the architecture has already accepted a fragile control point. Frameworks such as the NIST Cybersecurity Framework and Zero Trust architecture expect stronger verification than a single coerced approval.
👉 Read our full editorial: Credential-harvesting campaigns are exploiting device code flow
