Inside Wazza: A Newly Observed Device Code Phishing Kit Targeting Microsoft 365 Accounts

Wazza is a sophisticated phishing kit that targets Microsoft 365 users by sending phishing emails from compromised accounts containing PDF lures themed as business documents. Victims are redirected through a multi-domain infrastructure using Google Sites and CloudFlare Workers. The kit features 19 phishing themes impersonating services such as Adobe, DocuSign, and OneDrive, and includes six corporate decoy websites. It uses browser interrogation, anti-automation, and client-side protections to evade detection. The final stage abuses Microsoft OAuth device authorization by displaying a verification code and instructing victims to authenticate on a separate page. A backend session monitors the authentication process, enabling attackers to obtain access to victim accounts and cloud resources.

Successful exploitation results in attackers gaining unauthorized access to Microsoft 365 accounts and associated cloud resources by stealing user credentials through OAuth device code phishing. This can lead to data compromise, account takeover, and potential further abuse of compromised accounts.

No official patch or fix is applicable as this is a phishing campaign exploiting user interaction and OAuth flows. Mitigation focuses on user awareness training to recognize phishing attempts, implementing multi-factor authentication methods that are resistant to OAuth device code phishing, and monitoring for suspicious OAuth consent grants. Organizations should also consider conditional access policies and OAuth app consent restrictions to reduce risk.