Entra ID Device Code Phishing: Token Theft

One Entra ID account at the financial services firm was accessed through an unusual authentication path overnight. Working through the cloud sign-in and Graph audit trail, identify the user principal that the attacker's token belonged to.

Normal corporate users at this organization authenticate through standard flows that include MFA. The attacker exploited a different OAuth grant type that bypassed those controls. Identify the authentication method recorded in the anomalous sign-in event.

The attacker did not use a corporate or trusted address. Trace the earliest malicious activity in the cloud trail and identify the external IP from which the attacker initiated the OAuth token theft and first mailbox access.

The attacker registered an application in an external tenant to receive the stolen token. Identify the client ID of that application, as recorded in the Entra audit events.

The attack began with a phishing email that impersonated a Microsoft service. The sending domain is not affiliated with Microsoft. Identify the domain that sent the lure email to the victim.

Using the stolen token, the attacker called the Microsoft Graph API to access the victim's mailbox. Identify the exact Graph API path that was used to enumerate the inbox contents.

The attacker obtained a valid OAuth token for the victim's account without ever knowing the victim's password. Identify the MITRE ATT&CK technique that describes stealing application access tokens through deception of a user.