Inside Wazza: A Newly Observed Device Code Phishing Kit Targeting Microsoft 365 Accounts

LevelBlue SpiderLabs documents an active, modular phishing campaign named Wazza that uses business-themed PDF lures delivered from compromised mailboxes to redirect victims through trusted wrappers (Google Sites), routing/staging infrastructure (.eu domains and Cloudflare Workers), and client-side anti-automation checks into a final device-code OAuth phishing page impersonating services like Adobe/OneDrive; the kit programmatically generates tokens, monitors backend authentication state, and aims to obtain Microsoft 365 access via the OAuth device authorization flow, with numerous IOCs and detection guidance provided.