Microsoft 365 Device Code Phishing Campaign Bypasses Password Theft With Legitimate Login Flow

URL hxxp[://]ajz-gud[.]lisa-g-h-rn[.]workers[.]dev/ Phishing kit landing page URL hxxp[://]bakelite[.]ventoraco[.]com/doc98374/ Phishing kit landing page URL hxxp[://]biotechgroup[.]p-oye8mc0f[.]workers[.]dev/ Phishing kit landing page URL hxxp[://]bradhallfuel[.]p-oye8mc0f[.]workers[.]dev/ Phishing kit landing page URL hxxp[://]corpexl[.]nl/mq5qh1xj9/ Phishing kit landing page URL hxxp[://]corpexl[.]nl/oii/ Phishing kit landing page URL hxxp[://]corpexl[.]nl/projectorder/ Phishing kit landing page URL hxxp[://]creditor[.]me[.]uk/HPDGassocies Phishing kit landing page URL hxxp[://]dentalstrategies[.]noventragroup[.]app/dntrategie/ Phishing kit landing page URL hxxp[://]docxfile-share[.]itkljpqn[.]workers[.]dev/ Phishing kit landing page URL hxxp[://]docxfiletxz-share[.]itkljpqn[.]workers[.]dev/ Phishing kit landing page URL hxxp[://]gsbauwu1hsa[.]legislation[.]com/nmasn/ Phishing kit landing page URL hxxp[://]henriquevieira[.]horizontal[.]com/doc49390239/ Phishing kit landing page URL hxxp[://]horizonex[.]it[.]com/confidentialrecord/ Phishing kit landing page URL hxxp[://]horizonex[.]it[.]com/securedocument Phishing kit landing page URL hxxp[://]hsecontractors-project[.]sign-ins[.]workers[.]dev/ Phishing kit landing page URL hxxp[://]logvault[.]us/jfkydg4of/ Phishing kit landing page URL hxxp[://]mcagroup[.]horizontal[.]com/quote937847/ Phishing kit landing page URL hxxp[://]meeting[.]corpsfileshare[.]com/quarterly/ Phishing kit landing page URL hxxp[://]metroraco[.]com/GroupeBergeron/ Phishing kit landing page URL hxxp[://]metroraco[.]com/Wind/ Phishing kit landing page URL hxxp[://]microsoft-document[.]adhere[.]it[.]com/Adobe-pdf/ Phishing kit landing page URL hxxp[://]millerano[.]brieflync[.]nl/order9283/ Phishing kit landing page URL hxxp[://]mysharereport[.]wgmilshyvn[.]workers[.]dev/ Phishing kit landing page URL hxxp[://]onedrive-document[.]adhere[.]it[.]com/sharedproject/ Phishing kit landing page URL hxxp[://]retroactive[.]scalevantaco[.]com/adjustments Phishing kit landing page URL hxxp[://]review[.]wgmilshyvn[.]workers[.]dev/ Phishing kit landing page URL hxxp[://]sales[.]p-ct5v25xo[.]workers[.]dev/ Phishing kit landing page URL hxxp[://]Samoen[.]logvault[.]us/engineering Phishing kit landing page URL hxxp[://]sparkaxis[.]org/deployment/ Phishing kit landing page URL hxxp[://]tsk1[.]t31208026[.]workers[.]dev/ Phishing kit landing page URL hxxp[://]uboralmaxillofacialsurgery[.]noventragroup[.]app/uboralxillofia Phishing kit landing page URL hxxp[://]uegrail[.]pocket vault[.]nl/itiwa2 Phishing kit landing page URL hxxp[://]v379ge[.]meetrova[.]nl/p9mxbmz2x/ Phishing kit landing page URL hxxp[://]wpdoi8w[.]elevatecore[.]it[.]com/g4jlitpi/ Phishing kit landing page URL hxxp[://]wilderness hotels[.]sparkaxis[.]org/personaljflannigan/ Phishing kit landing page URL hxxp[://]zktxnxlh[.]wastefully[.]com/snzv8wq Phishing kit landing page URL hxxps[://]adhere[.]it[.]com/verify/ Phishing kit landing page URL hxxps[://]apexviaco[.]com/code/ Phishing kit landing page URL hxxps[://]corpexl[.]nl/INV/ Phishing kit landing page URL hxxps[://]corpexl[.]nl/PO/ Phishing kit landing page URL hxxps[://]corpexl[.]nl/securee/ Phishing kit landing page URL hxxps[://]covenant[.]it[.]com/Project/ Phishing kit landing page URL hxxps[://]creditor[.]me[.]uk/NorthShore/ Phishing kit landing page URL hxxps[://]docusign-arizonacreativeevents[.]nextvexharbor[.]from /review/ Phishing kit landing page URL hxxps[://]docusign-stlequityhomes[.]nextvexharbor[.]from /review/ Phishing kit landing page URL hxxps[://]fortknox[.]noventragroup[.]app/fortknoxxx/ Phishing kit landing page URL hxxps[://]growthora[.]app/doc/ Phishing kit landing page URL hxxps[://]horizonex[.]it[.]com/confidentialfile/ Phishing kit landing page URL hxxps[://]login[.]growthora[.]app/document/ Phishing kit landing page URL hxxps[://]meeting[.]corpsfileshare[.]com/quarterly/ Phishing kit landing page URL hxxps[://]metroraco[.]com/Desjardinsh/ Phishing kit landing page URL hxxps[://]metroraco[.]com/InnovativePipeline/ Phishing kit landing page URL hxxps[://]momentoraco[.]com/Project-submittal/ Phishing kit landing page URL hxxps[://]momentoraco[.]com/project-document/ Phishing kit landing page URL hxxps[://]my-team-share[.]corpsfileshare[.]com/team/ Phishing kit landing page URL hxxps[://]nexttrail[.]co[.]nl/m365scoft/ Phishing kit landing page URL hxxps[://]onedrive-encrypted-online[.]clearledge[.]me[.]uk/avc8xt/ Phishing kit landing page URL hxxps[://]onedrive-encrypted[.]clearledge[.]me[.]uk/aar0cphl/ Phishing kit landing page URL hxxps[://]onedrive-microsoft[.]adhere[.]it[.]com/securedocument/ Phishing kit landing page URL hxxps[://]payroll[.]vardeno[.]nl/employee/ Phishing kit landing page URL hxxps[://]ringcentral[.]firmtix[.]com/alert/ Phishing kit landing page URL hxxps[://]ringcentral[.]firmtix[.]com/notify/ Phishing kit landing page URL hxxps[://]secure[.]firmtix[.]com/docx Phishing kit landing page URL hxxps[://]sparkaxis[.]org/delivery/ Phishing kit landing page URL hxxps[://]sparkaxis[.]org/statement/ Phishing kit landing page URL hxxps[://]stratifylabs[.]org/BDAGroup/ Phishing kit landing page URL hxxps[://]stratifylabs[.]org/FACTURE/ Phishing kit landing page URL hxxps[://]teams[.]vardeno[.]nl/fileshared/ Phishing kit landing page URL hxxps[://]trenix[.]nl/alma-resort/ Phishing kit landing page URL hxxps[://]fervent[.]futureanchor[.]it[.]com/cloud/ Phishing kit landing page URL hxxps[://]verification[.]futureanchor[.]it[.]com/cardcrosoft/ Phishing kit landing page URL hxxps[://]vmservfile[.]nkydzvws[.]workers[.]dev/ Phishing kit landing page Network Hostname login.microsoftonline.com Legitimate Microsoft authentication endpoint abused in Device Code flow Network Hostname aka.ms/devicelogin Legitimate Microsoft device login URL referenced in phishing lures Network Hostname login.live.com/oauth20_remoteconnect.srf Legitimate Microsoft Live auth endpoint abused in phishing kit CHILDREN Rule DeviceCode_Phishing_LandingPageHTML YARA detection rule for Device Code phishing kit landing pages (authored by Malware Utkonos, dated 2026-05-20)