Traced a full stage device code phishing chain hitting Italian corporate targets 🇮🇹
Starts clean: password-protected SharePoint share on a compromised tenant / no SEG blocks a OneDrive link, ever.
Lure is a .pdf[.]docx double-extension doc rendering a fake OneNote notification.
Click lands you on sharecloud[.]pincha[.]click, a Node[.]js/Express C2 behind Cloudflare with a dual bot gate: first a WebGL/battery/timezone fingerprint POST to /api/t returning {"b":0} for scanners and {"b":1} for humans, then a Turnstile CAPTCHA layer on top. Both have to pass before you see anything interesting.
Once through, the kit calls /api/device/start server-side Microsoft hands back a device_code (stays on the C2) and a user_code (shown to the victim as "your access code").
Victim clicks "Continue to Microsoft", lands on the real microsoft[.]com/devicelogin, enters the code, completes MFA against Microsoft's own infra, meanwhile the C2 is polling /api/device/status/{sessionId} every 3 seconds. The moment Microsoft says completed, the server holds a valid access_token refresh_token for the victim's M365 tenant.
🧬IOC🧬:
sharecloud[.]pincha[.]click → main C2 (fake OneDrive)
pincha[.]click → attacker base domain
qcg-media[.]scanova[.]io → post-token-theft redirect
/api/device/start → device_code request endpoint
/api/device/status → auth completion polling endpoint
0x4AAAAAAC1ZxGOR3ikWuiS3 → Cloudflare Turnstile sitekey C2
@JAMESWT_WT