Detect It Early: Mir0Auth Uses Obfuscated Network Logic for M365 Token Access
Source Reddit ThreatIntel
Discussion
Mir0Auth is a phishing toolkit targeting Microsoft 365 authentication tokens. It uses a multi-step phishing flow starting with a business email lure and a PDF attachment leading to a DocuSign-themed page. Victims are redirected to a legitimate Microsoft Device Code authentication page, allowing attackers to obtain M365 tokens. The toolkit employs obfuscated network communication using XOR encoding for command-and-control URLs and payloads. Primary activity has been observed against US organizations.
r/threatintel (opens in a new tab)u/ANYRUN-team0 points0 comments
We identified Mir0Auth, a new phishkit targeting M365 auth tokens, with primary activity observed against US organizations. A business email lure with an attached PDF leads to a DocuSign-themed page, then to legitimate Microsoft Device Code authentication, where the attacker’s session obtains M365 tokens.
Mir0Auth uses source-code-like endpoints, including /task_queue.cs, /context.go, and /window.rs, to manage the flow and session state.
See the analysis session: https://app.any.run/tasks/a1553640-c0f5-4d33-a535-36e13dd22f5f/
Network chain:
Phishing page ➡️ POST /task_queue.cs beacon ➡️ POST /context.go returns a device code ➡️ the code is copied to the clipboard, and the legitimate Microsoft sign-in page at microsoft[.]com/devicelogin opens in a popup ➡️ /window.rs session polling every 3s ➡️ victim signs in ➡️ attacker session receives M365 tokens
Traffic obfuscation:
– C2 URLs are hex strings XORed with MiroAuth
– C2 bodies are JSON XORed with M1r0AuthBinProT0c0l_2024!
– Data is sent as raw application/octet-stream; responses use the same key
Pivot from IOCs and subscribe to query updates to proactively track evolving activity.