Device Code Phishing Is Dead, Long Live New Azure AD Attacks!

Overview: Elias, head of red team at Orange Cyberdefense, presents at Insomni'hack on new Azure AD attack vectors beyond device code phishing, including techniques validated in four red team operations.

Key Topics: Azure AD authentication mechanisms and their attack surfaces; device code phishing limitations; new social engineering vectors for token theft; password spraying effectiveness; and coordination with Microsoft on disclosure.

Technical Details: Elias demonstrates attack flows where victims receive codes to enter on legitimate Microsoft sites, completing authentication including MFA. He also covers password spraying against valid email lists with common passwords, noting its continued effectiveness despite visibility.

Takeaways: Azure AD's diverse authentication options create multiple attack paths beyond device code phishing. Organizations should monitor for anomalous authentication patterns and enforce strong password policies.