(levelblue.com) Wazza: A Multi-Stage Device Code Phishing Kit Targeting Microsoft 365 Accounts Through Evolving Techniques In brief - This article analyzes Wazza, a sophisticated multi-stage phishing kit that utilizes device code phishing to compromise Microsoft 365 accounts. The campaign employs a complex infrastructure of PDF lures, trusted wrappers, and decoy websites to deceive users into granting OAuth access to attackers. Technically - This article details a four-stage attack chain starting with business-themed PDF lures that redirect victims through Google Sites wrappers and a custom routing framework. The Wazza kit implements advanced evasion techniques, including dynamic phishing themes, time-based decoy corporate homepages, and a client-side protection layer (KPSDK) that uses PBKDF2-SHA256 and AES-256-GCM to encrypt browser interrogation data (detecting Selenium, Puppeteer, and headless browsers). The final stage abuses the Microsoft OAuth device authorization flow, using a backend api.php endpoint to synchronize verification codes and monitor authentication status in real-time via polling, ultimately bypassing traditional credential harvesting in favor of token-based account access. Source: https://www.levelblue.com/blogs/spiderlabs-blog/inside-wazza-a-newly-observed-device-code-phishing-kit-targeting-microsoft-365-accounts #Cybersecurity