SquarePhish 2.0

The talk revisits device code phishing, where an attacker starts a Microsoft device code sign-in and the victim completes it on a legitimate login page, yielding post-authentication tokens that arrive after MFA. The speakers explain why earlier approaches struggled with the flow's 15-minute expiry and with getting consent for SMS lures, and why QR codes hide the malicious link and shift scanning to a phone outside corporate controls.

They present SquarePhish 2.0, a rewrite from Python command line to Go with a web portal for managing campaigns, configuration and captured tokens. The first email carries a QR code that does not expire and only triggers the server; a second email, sent once the victim is already engaged, carries the device code, which keeps the window tight. The update defaults to the authentication broker client ID, automates device registration and converts a refresh token into a primary refresh token, which gives single sign-on access. A new option applies a technique from Dennis Kneep that enters the code automatically for federated users. A live demo walks through the full chain, from inbox to a browser signed in with the PRT.

For defenders, the talk recommends hunting for the broker client ID in device code logs, allow-listing rare legitimate uses, and blocking device code flow through conditional access. Location limits, compliant or hybrid-joined device requirements and impossible travel alerts are also suggested.