Web Security | He (Shawn) Shuang's Personal Site

Device Code Phishing Evasion Techniques

Fri, 24 Jul 2026 00:00:00 +0000

We observed device-code phishing campaigns using four complementary evasion techniques. CAPTCHA gates block basic URL scanners while mimicking legitimate Microsoft security checks, and multi-step flows route victims through trusted SaaS platforms before revealing the phishing page.

Other campaigns decrypt phishing HTML inside the browser and deliver it through a session-unique blob URL that blocklists cannot retrieve. The pages also disrupt content detection with Cyrillic lookalike characters, zero-width spaces and randomized strings embedded in <bdi> elements, while remaining visually convincing to victims.

Device Code-based OAuth Phishing

Mon, 23 Mar 2026 00:00:00 +0000

This active campaign abuses Microsoft’s legitimate device-code OAuth flow to capture application tokens instead of passwords. Victims interact with a real Microsoft sign-in page while the attacker’s infrastructure obtains the resulting token in the background.

The phishing pages combine trusted authentication flows with obfuscated payloads, developer-tool detection and debugger traps. A captured OAuth token can provide application-level access to email, files and identity data without exposing the victim’s password.

IOCs for phishing pages using blob URLs

Thu, 02 Oct 2025 00:00:00 +0000

Several active phishing campaigns use blob URLs to deliver their final pages. Rather than loading all malicious content over the network, the pages construct it dynamically in browser memory at runtime.

This delivery method can reduce the visibility available to network-based analyzers and complicate conventional URL inspection.