Storm-2945, a Midnight Blizzard sub-cluster, is running a device code phishing campaign from hijacked hotel Wi-Fi networks to bypass MFA and compromise Microsoft 365 accounts. The attack exploits the legitimate OAuth device code flow — designed for browserless devices — by having a captive portal request a device code on the attacker's behalf and tricking the victim into completing MFA themselves, unknowingly authenticating the attacker's session. The campaign also deploys two malware tools: CornFlake (a Go-based RAT) and ChocoShell (an in-memory PowerShell infostealer targeting M365 tokens). Detection involves reviewing Entra ID sign-in logs for device code flow authentications from unusual IPs, and hunting specific IOCs. The primary fix is disabling the device code authentication flow in Conditional Access for accounts that don't need it, combined with phishing-resistant MFA (passkeys), continuous access evaluation, and Security Service Edge routing for traveling staff.
