Full transcript
0:00One of the ways that cyber-criminals
0:02steal your Azure Microsoft 365 accounts
0:05or take over and compromise your Entra
0:07ID identities is with the technique
0:10called device code fishing. And this
0:12technique takes advantage of a genuine
0:15legitimate sign-in process, device code
0:17authentication. You can think of it like
0:19you're trying to sign in to Netflix on
0:21your TV. All you have is your remote, so
0:23they give you some random string of
0:26letters and numbers, a code, to
0:28authenticate that device. And for some
0:31reason, Microsoft has support for this,
0:33not that you'd ever log in to Outlook or
0:34Teams or SharePoint on your TV, but it
0:37allows a full sign-in and it is
0:39extremely over permissive. And we've
0:42covered the device code fish plenty of
0:44times on this channel. The most sinister
0:46part is that it basically bypasses, air
0:49quotes, bypasses two-factor
0:51authentication because it ends up going
0:53through the real genuine authentication
0:56process to official Microsoft. So, very
0:59recently, just a few weeks ago at my day
1:02job, I work at Hunters, by the way, if
1:03you weren't already aware, we saw a
1:05surge in Microsoft 365 fishing attempts.
1:09And what looked like a huge device code
1:12fishing campaign that's fast and unique
1:14to every single potential target or
1:16victim because hackers, threat actors,
1:19cyber-criminals are leveraging AI.
1:21Here's the skinny, over 340 different
1:24organizations across the globe, getting
1:27started at the end of February, and in
1:29March it exploded, impacting all
1:31different kinds of organizations, law
1:33firms, construction companies, schools,
1:36and there has been no identical fishing
1:38lures or initial domains. Each lure is
1:41personalized to the victim while
1:43avoiding exact replication. Let me show
1:45you one of these live fishing pages that
1:47is still online. You can see, oh, a fake
1:50DocuSign setup, please verify your
1:52identity with Microsoft, and they give
1:53you a verification code. You would click
1:56copy and then sign in to Microsoft here
1:58with the genuine pop-up for actual
2:01Microsoft online login. Going through
2:03the steps here is literally giving
2:05hackers your account. Now, I wanted to
2:07show you some behind the scenes because
2:10we're getting a little inundated from
2:11signals and events and alerts from this
2:13device code off flow from Railway. Now,
2:17Railway is a, again, legitimate,
2:20genuine, like actual third-party
2:22solution that has good intents, just
2:24being used and abused, but it is a
2:26platform as a service. So, what that
2:28means is that you could leverage AI and
2:31spin up a Docker container, a GitHub
2:33repository, put it on AWS
2:35infrastructure, Cloudflare, whatever you
2:37want. You just prompt it into existence.
2:40It's vibe coding infrastructure. So,
2:43threat actors and cyber-criminals say,
2:45"Hey, this is pretty easy." They can
2:48just seamlessly spin up whatever they
2:50want, and in this case, being used and
2:52abused, leveraged to host infrastructure
2:55for this device code fishing campaign.
2:58And let me be clear, I'm not saying this
3:00is fishing or malicious intent from
3:02Railway, the platform itself, but the
3:04platforms that it serves and hosts via
3:07Railway's infrastructure. To give you a
3:09better visualization, shout-out and
3:11credit to another teammate, Casey, and
3:13of course, Tanner from just previously.
3:14Casey put together a little video demo
3:16to see Railway in action. So, I'm
3:18speeding through it a little bit, but
3:19you can see on the right-hand side, the
3:21prompt is to create a reverse proxy so
3:23that that way we could capture all
3:24connections, all requests, all messages
3:27sent back and forth in the traffic. You
3:28back this to a GitHub repository, you
3:30hook it up with networking and DNS, and
3:33just like that, you have a ready-made
3:35working fishing lure. Casey plays
3:37pretend victim, goes through the login
3:39process, enters his password, goes
3:41through multi-factor authentication, and
3:43then thinks he's authenticated,
3:45naturally logged in to Azure, but all of
3:47that traffic has now been captured, and
3:49the hackers have stolen the secrets to
3:52fully steal and compromise that account.
3:54So, cyber-criminals take advantage of
3:56this AI-powered platform as a service to
3:58basically do fishing as a service. These
4:01superpowers effectively give adversaries
4:04a cloud-hosted token harvesting engine
4:06that is clean to Microsoft's risk
4:08scoring, and they are seizing that
4:10opportunity. I'm not going to drag you
4:12down through the entire blog post. There
4:14will be a link in the video description
4:16if you're interested on this, a little
4:17bit more insight on what device code
4:19fishing is, a little bit more insight
4:21into Railway, but realistically, the
4:23infrastructure that it uses and how it
4:25is being used and abused to perform
4:28these attacks. Some neat-o things to
4:30draw your attention to, though, is that
4:31it's leveraging a lot of different
4:33redirect services, again, legitimate,
4:35trusted vendor domains, Cisco secure
4:37email, Trend Micro URL protection,
4:39Mimecast, and they use these to bounce
4:42the victim, so email security filtering
4:44is not going to get in the way. Whether
4:46it's Cloudflare worker pages or
4:48compromised domains or any of these sort
4:51of amalgamations, pick and choose
4:53however many puzzle pieces you want, two
4:55hops, three hops, or four hops, you
4:57eventually land on the lure site. And I
4:59want to show you a couple of these lures
5:01because they're across different
5:03industries or sectors and using the
5:05appropriate, oh, little dangling carrot
5:07that makes sense for that work, whether
5:09it's construction bids or DocuSign,
5:11sending documents, business partnership
5:13agreements, fake voicemails, password
5:16expiration, and they have a good many of
5:18these, all completely faked to look like
5:22an application that you're expecting,
5:23but totally a lie. The final ending site
5:26is undeniably a Cloudflare workers.dev
5:29instance, and they all seem to have a
5:30certain sort of schema, some sort of
5:32standard convention for how these lures
5:34are hosted, and we'll see a good many of
5:36them. I want to show you a couple more
5:38of those lure pages that we saw, but if
5:40I may, one of the coolest things about
5:43this saga and story is that we got to
5:45collaborate with my friends over at
5:47Flare. Flare helped us attribute the
5:49Railway attack to Evil Tokens, a
5:52fishing-as-a-service platform that has
5:54been chirping in Telegram. If you aren't
5:56familiar, Flare is an awesome data
5:58source and a threat exposure management
6:00platform and solution. So, any of your
6:02exposed info, like credentials or
6:05cookies or sessions, things that could
6:07tie back to your data or your account or
6:09your identities, they're tracking it
6:11across the dark web, the clearnet,
6:13Telegram, shady ransomware leak sites,
6:15marketplaces, forums, all the illicit
6:17and illegal spots where that data is
6:19just shared. Across infostealer malware
6:22logs, they're tracking over like 2
6:24billion credentials, and of course, they
6:26have this hooked up and integrated with
6:28your Entra ID environment. So, if there
6:30is any spill, leakage, or account that's
6:32at risk and in danger, about to be
6:34compromised, they can lock it down and
6:36prevent that. But, the real secret sauce
6:39is their data. Because Flare has this
6:42unparalleled insight into the ecosystem,
6:44dark web, and cybercrime, I can go take
6:46a look at their events page, and while I
6:48will automatically be in my current
6:50tenant feed for different identifiers
6:52that I set up for my own organization or
6:54you to protect your own, I could just
6:55straight up search like Google search,
6:58"Hey, anything related to Evil Tokens?"
7:00And whether it's from different data
7:02sources, like anything on the dark web
7:05or on the open internet, or I could
7:07toggle for a date range or any sort of
7:09severity, but here we go. I already see
7:11Evil Tokens chatting on Telegram. And
7:13they'll give you the dark web onion link
7:15if it's something on Tor or the Telegram
7:18channel, and of course, we could explore
7:19the content, even AI-assist, any of the
7:21operations and things they see here. I
7:23want to scroll through the Evil Tokens
7:25Telegram channel just to see what
7:27they're chatting about, but before I do,
7:28I did want to show you the collections
7:30page on Flare's platform because
7:32goodness gracious, they have so much
7:34insight. Wild to see all of the billion
7:37events and more that they're tracking
7:39for infostealer malware logs, Telegram
7:41chat signals, forums, marketplaces, and
7:44if you want to drill down into even
7:45named data breaches or other Telegram
7:48channels that they are aware of, there's
7:50just an insane amount of stuff here, and
7:52it gives you legitimate, genuine cyber
7:54threat intelligence for what is
7:56targeting your industry and sector. Big
7:58shout-out to Flare, you know I'm a huge
7:59fanboy, incredible people, incredible
8:01work, incredible research, and just
8:03awesome stuff. Hope you take a look at
8:04them, link below in the video
8:05description. Thanks again to Flare for
8:07sponsoring this video and helping us out
8:09in the Railway case. So, for funsies,
8:11let's take a look at the Evil Tokens
8:13Telegram. Starting way back when, they
8:16are introducing Evil Tokens B2B,
8:19business-to-business sender version 0.1.
8:22And I think, look, honestly, this is a
8:24testament to how cybercrime has become
8:29so monetized, how it is literally an
8:32industry, it is genuinely an ecosystem,
8:35and it is a product. They are buying and
8:38selling this capability to perform this
8:41illegal access. They have the bot
8:44itself, which is the actual store, so to
8:48speak, to be able to buy and get
8:51specific tooling, Evil Tokens device
8:53capture marketplace. And if you wanted
8:56to, you just click along through this to
8:59perform each of these things. Let me
9:02check the Office 365 capture link. You
9:05can see, they're talking a whole
9:06back-end management panel, secure
9:08session architecture, inbox management
9:11so that you have a dashboard, and here
9:13it is, bypassing Microsoft security
9:15controls, capturing tokens without
9:16credentials, however they go about
9:18whatever of these offerings, but their
9:20support chat is totally AI-oriented. I
9:23want to scroll through and find, oh,
9:25they're talking about, oh, their
9:26community feedback. "We always
9:28appreciate hearing from members of the
9:29community who are actively using the
9:31tools and sharing their experience."
9:33Goodness gracious. You can see some
9:35pictures of their back-end, and here are
9:37they're discussing open redirect's
9:39capability. Oh, even ICS fishing with
9:42like calendar invites. Man. But look at
9:45it, they're just selling the product,
9:47built for serious users, limited stock,
9:49buy now. They have a freaking referral
9:52program.
9:54>> [laughter]
9:54>> Look at some of the pictures they're
9:55showing of, uh, how you can use their
9:58like builders to build and deploy Adobe
10:01Acrobat DocuSign, voicemail, one-click
10:03deployment to Cloudflare workers. Yep,
10:05yep, they got testimonials and I'm still
10:08scrolling through February right now.
10:11Look at this, capture link support all
10:12Microsoft email, Mimecast, Cisco Secure
10:15Email, exactly what we were alluding to
10:16here. All right, I'm getting into March
10:19and they do discuss a bit of their
10:21monthly subscription and I wanted to
10:23highlight that because I think it'll be
10:25a little important Easter egg. And
10:26remember March is the timeline where
10:28we're seeing this thing explode. And
10:30there they go, look, they say it, "Hey,
10:31we're using AI." Sharing some
10:33screenshots of the exact functionality
10:36that we have seen. Like you saw exactly
10:38this interface and here we go down
10:40below, AI upgrade, smarter tools. They
10:43have a 15-minute video. Geezom, I'm just
10:47clicking through to see a bit of the
10:49interface here. Cloudflare workers,
10:52goodness, look at all the keyword
10:53suggestions that they've got there. And
10:55the settings let them build it into
10:57Telegram, add two-factor authentication,
11:00it's a whole app. And look at this,
11:01they're getting to customize their
11:03little template here, exactly what we
11:05saw. They go take a look at it displayed
11:08and yeah, it's the exact same. They're
11:10literally all the different sort of all
11:12displays for it. Goodness gracious,
11:14that's wild. Log into Microsoft, take
11:17over your account.
11:19There they go. I'm going to have to
11:20redact a lot of this cuz I don't know if
11:22it is a true victim or not, but look at
11:24it, they're open up the little extension
11:26here that they've got to do a actual AI
11:29scan of their email. Of all the
11:32communications that victim might have
11:33had. Look at it, it's so vibe coded.
11:36So without a doubt, absolutely. Look,
11:38threat actors, cybercriminals, they are
11:40on the move with AI. Especially for, you
11:44know, I think what a lot of us maybe had
11:45in mind as a sci-fi doomsday where you
11:48have genuinely unique, however many
11:50permutations, absolutely distinct,
11:52totally personalized lures and lies for
11:55every single potential victim. Kind of
11:58crazy. So we did go ahead and report all
12:01of domains that we were tracking, but
12:03there are still some that are still live
12:05and haven't been taken down quite yet.
12:07So for our last hurrah, I thought we
12:09could go through a couple of them that I
12:11have here. I am going to have to redact
12:13because I believe it looks like it has a
12:15component or part and piece of a
12:17potential victim name in the URL. So
12:19let's take a look at the very first one
12:21and this is what I was alluding to. Kind
12:24of wild, kind of funny. You can see,
12:25look, the subscription expired. Whoever
12:28was using this for their mass fishing
12:30campaign with Evil Tokens has their
12:33subscription to Evil Tokens expired, so
12:35all the bells and whistles are not going
12:37to function. They haven't paid the
12:39bills. Totally fishing as a service.
12:41This one we get hit with the old Google
12:43Chrome dangerous site here. We can visit
12:45along anyway and that's exactly that.
12:48Another expired. A lot of these that
12:51we're seeing are DocuSign, but okay,
12:52yeah, this is exactly another that is
12:55live still.
12:57This one was a Cloudflare worker page
12:59that I assume was taken down. Here was
13:00the Adobe Acrobat that we saw. Not a
13:03huge variation in the templating here.
13:06This one was a meeting invite, but I
13:08thought the subscription expired was
13:11just really funny and I wanted to show
13:12you. One other peculiar thing though,
13:15the timeline of us hey spreading the
13:17word, sharing, releasing the articles
13:19and getting the word out about this
13:20thing, it's hitting the news, right?
13:22Hey, The Hacker News is publishing about
13:23it. They cover this device code fishing
13:25story on March 15th tracking our work
13:28and the Evil Tokens Telegram channel
13:31>> [laughter]
13:31>> forwards it and has [clears throat] a
13:33couple heart emoji reactions. So it's
13:36pretty clear, right? It's it's confirmed
13:38that is Evil Tokens. And again, big
13:40thanks to Flare for helping us out here.
13:42That was really cool to just genuinely
13:44get hey some industry collaboration and
13:46partnership here and we're all doing
13:47really good stuff the best we can.
13:49They'd help provide a lot of the
13:50insights and I wanted to help share that
13:52story cuz it is a wild one in my mind.
13:55Link below in the video description for
13:56all the things, especially if this is
13:58probably pretty pertinent to you. We
13:59could see even more insight from other
14:01abused domains, some of the user agents
14:04that you might be able to key off of,
14:05more data and statistics on the specific
14:08sectors, what they're targeting, what
14:10they're using leveraging here. And if
14:12you need some other mitigation advice
14:13for your own response, for your own
14:16remediation, there are some more
14:18insights in the indicators of
14:19compromise, detection rules, everything
14:21that you'd like and need all down below.
14:23And that's today's world, right?
14:25AI-powered for better or for worse, for
14:27good and evil and cybercriminals, threat
14:30actors, they are taking advantage of.
14:32They are first movers and solutions like
14:35that we want to innovate and create even
14:37for ourselves to do good things are
14:38still going to be used and abused by bad
14:41actors. Both on the endpoint, both on
14:43identity, both for your data, your
14:45exposed attack surface. So that's the
14:47gist, that's the wrap-up and thank you.
14:49Thanks to Huntress for not firing me yet
14:51and thanks to Flare for sponsoring this
14:52video and their continued support of the
14:54channel. Thank you. Please do all those
14:56YouTube algorithm things like comment,
14:57subscribe and I'll see you in the next
14:59video.