---
title: "Device Code Phishing Is How Midnight Blizzard Beat MFA on Hotel Wi-Fi"
url: https://daily.dev/posts/device-code-phishing-is-how-midnight-blizzard-beat-mfa-on-hotel-wi-fi-pakr92sbk
source_url: https://latesthackingnews.com/2026/08/03/device-code-phishing-detection
type: article
source: "Latest Hacking News"
published: 2026-08-03T11:13:14.591Z
updated: 2026-08-04T00:23:08.538Z
tags: ["microsoft", "authentication", "phishing", "oauth"]
reading_time: 5
upvotes: 0
comments: 0
language: en
---

> ## Documentation Index
> Fetch the complete documentation index at: https://daily.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Device Code Phishing Is How Midnight Blizzard Beat MFA on Hotel Wi-Fi

**[Latest Hacking News](https://daily.dev/sources/lhn)** · 5 min read · 0 upvotes · 0 comments

## Summary

Storm-2945, a Midnight Blizzard sub-cluster, is running a device code phishing campaign from hijacked hotel Wi-Fi networks to bypass MFA and compromise Microsoft 365 accounts. The attack exploits the legitimate OAuth device code flow — designed for browserless devices — by having a captive portal request a device code on the attacker's behalf and tricking the victim into completing MFA themselves, unknowingly authenticating the attacker's session. The campaign also deploys two malware tools: CornFlake (a Go-based RAT) and ChocoShell (an in-memory PowerShell infostealer targeting M365 tokens). Detection involves reviewing Entra ID sign-in logs for device code flow authentications from unusual IPs, and hunting specific IOCs. The primary fix is disabling the device code authentication flow in Conditional Access for accounts that don't need it, combined with phishing-resistant MFA (passkeys), continuous access evaluation, and Security Service Edge routing for traveling staff.

## Full article

daily.dev links to this article rather than hosting it. Read it at the original source: <https://latesthackingnews.com/2026/08/03/device-code-phishing-detection>

## Similar posts on daily.dev

- [Device Code Phishing: Turning a Convenience Feature Into an MFA Bypass](https://daily.dev/posts/device-code-phishing-turning-a-convenience-feature-into-an-mfa-bypass-ahmi9uip7) · Trend Micro · 0 upvotes · 0 comments

---

Tags: [#microsoft](https://daily.dev/tags/microsoft), [#authentication](https://daily.dev/tags/authentication), [#phishing](https://daily.dev/tags/phishing), [#oauth](https://daily.dev/tags/oauth)

[View this post on daily.dev](https://daily.dev/posts/device-code-phishing-is-how-midnight-blizzard-beat-mfa-on-hotel-wi-fi-pakr92sbk)