A phishing kit called Wazza is taking over Microsoft 365 accounts without stealing a password and without tripping an MFA prompt. It convinces the victim to type in a genuine Microsoft device code, which hands the attacker a token instead of a credential.
What happened
LevelBlue SpiderLabs published its analysis on 20 October 2026. The kit has been active since at least early July 2026 and was still running when the research went out.
The chain starts in an already-compromised mailbox: an email arrives from a real, known sender carrying a PDF with a business lure - invoice, contract, confidential document, urgent review. The PDF is mostly an image with SharePoint branding and a hyperlink. That link passes through a Google Sites wrapper, which stores the destination in a data-url attribute so it never appears in the page source, or goes straight to a .eu domain via URL rewriting services.
From there a 56 KB script filters visitors. Automated browsers - Selenium, WebDriver, Puppeteer, Playwright, headless user agents, open developer tools - are detected and the traffic is quietly redirected to one of six decoy corporate websites: a private bank, a clinic, a law practice, an energy company, a property firm and a project management vendor. Those decoys rotate every hour. Real victims get a fake Adobe, DocuSign or OneDrive page across 19 themes spanning file sharing, banking, payments, HR, cloud infrastructure and e-signature.
At the last step the page asks its backend for a device code and gets back a real one from login.microsoftonline.com, plus an expiry time. It polls every two seconds, refreshes the code when it lapses, and shows "Access Verified" once the attacker's side registers the sign-in.
Who is affected
Anyone running Microsoft 365 and Entra ID with the device code flow available to staff, and anyone whose users open external PDF attachments that contain links:
- Organisations that have never reviewed Entra authentication flows, where device code is enabled by default for the tenant.
- Staff who handle invoices, contracts and document shares from outside parties - finance, admin, sales and reception in an SME.
- Firms with a single compromised mailbox, because the next wave of lures is sent from a familiar address and looks internal.
- Any tenant where a token, rather than a password, is what an attacker needs: mailbox rules, SharePoint and OneDrive files, Teams, and onward phishing all follow from it.
What to do now
Turn off the device code flow in Entra ID unless you actually use it, and where you do need it, restrict it with Conditional Access to managed devices or trusted locations.
- In Entra ID, create a Conditional Access policy targeting the "Device code flow" authentication flow and block it for all users except a named group.
- Tell staff plainly: a page that asks you to copy a code and paste it into a Microsoft sign-in you did not start is an attack, even when the Microsoft page itself is genuine.
- Hunt your sign-in logs for device code authentication events, then look for new OAuth consent grants, new inbox forwarding rules, delegated mailbox access and unfamiliar registered devices in the same session.
- Correlate email, web and identity logs: a device code sign-in minutes after a user opened a PDF attachment or a document-sharing page should be treated as one incident, not three.
- Apply stricter handling to external PDFs that contain links - strip or sandbox them, and warn users rather than silently delivering them.
What this means for South African businesses
This is the most common shape of Microsoft 365 compromise I see, and it is a poor fit for the controls most SMEs have bought. MFA does not help, because the user completes MFA on the real Microsoft page; a password reset does not help either, because no password was taken. If your tenant has never had the device code flow audited, assume it is open and check it this week - the fix is one Conditional Access policy, and it costs nothing.
Source: LevelBlue SpiderLabs: Inside Wazza, a device code phishing kit targeting Microsoft 365 accounts, 20 October 2026.
Also on the blog
Next step: If this is on your network or a client's, ask Matthews Enterprises to check exposure.