Observed phishing campaign leveraging Gmail accounts to deliver emails containing only the password for a supposed “secure” PDF attachment.

Victim flow:

1. Email contains only the password for the attachment
2. Email also includes a PDF attachment
PDF contains a link redirecting to a fake secure document portal
3. User is prompted with Microsoft device login / OAuth-style authentication
4. Credential theft and session hijacking likely follow

Associated IOC domains:

* omegabearings[.]com
* vaisooru[.]com
* roufoka[.]com

Recommend:
• Block domains at DNS/proxy layers
• Hunt for related OAuth/device code login events
• Review Entra ID sign-in logs
• Reset sessions/tokens for impacted users
• Monitor for suspicious consent grants

#Phishing #CredentialPhishing #Microsoft365 #EntraID #AzureAD #OAuth #DeviceCodePhishing #ThreatIntel #IOC #BlueTeam #DFIR #SOC #CyberSecurity #ThreatHunting #Infosec #EmailSecurity #CTI #IncidentResponse

Tycoon2FA Exploits Microsoft 365 with Device-Code Phishing

Beware of Tycoon2FA's sneaky phishing tactics: victims are tricked into granting OAuth tokens to attackers through Microsoft's own device-login flow after clicking a malicious link. This comeback kid of a phishing kit has bounced back from a March disruption, now with added layers of obfuscation to evade detection.

https://osintsights.com/tycoon2fa-exploits-microsoft-365-with-device-code-phishing?utm_source=mastodon&utm_medium=social

#Tycoon2fa #Microsoft365 #Phishing #DevicecodePhishing #Oauth

📢 Explosion du device code phishing en 2026 : 37,5x d'augmentation et émergence du kit EvilTokens
📝 ## 🔍 Contexte

Article publié le 4 avril 2026 par Luke Jennings (VP R&D, Push Security) sur le blog pushsecurity.com.
📖 cyberveille : https://cyberveille.ch/posts/2026-09-04-explosion-du-device-code-phishing-en-2026-375x-d-augmentation-et-emergence-du-kit-eviltokens/
🌐 source : https://pushsecurity.com/blog/device-code-phishing
#DeviceCodePhishing #EvilTokens #Cyberveille

📢 Montée en puissance du device code phishing en 2026 : analyse des kits et campagnes
📝 ## 🗓️ Contexte

Article publié le 4 avril 2026 par Luke Jennings sur le blog de Push Security.
📖 cyberveille : https://cyberveille.ch/posts/2026-04-04-montee-en-puissance-du-device-code-phishing-en-2026-analyse-des-kits-et-campagnes/
🌐 source : https://pushsecurity.com/blog/device-code-phishing/
#DeviceCodePhishing #EvilTokens #Cyberveille