Spectra Analyze in Action: Hunting Device Code Phishing Pages

This report details an active Microsoft 365 device-code phishing campaign that leverages the OAuth 2.0 Device Authorization Grant to trick victims into authorizing attacker-controlled devices, rather than capturing passwords. The write-up includes a YARA rule to detect phishing landing pages, instructions for running cloud retro-hunts and hunting results (765 matched samples, with recent activity), plus guidance for retrieving and analyzing matched HTML landing pages in Spectra Analyze for threat hunting and detection.