Executive Summary
Mir0Auth is a specialized phishing kit that leverages the OAuth device authorization grant flow to compromise user sessions without harvesting traditional credentials or triggering standard "impossible travel" alerts. The attack begins with a business-themed email containing a PDF that leads to a DocuSign-spoofed landing page. Once the victim is lured to the site, the kit automates the generation and presentation of a Microsoft device code, tricking the user into completing a legitimate authentication process on Microsoft's own domain.
Technically, the kit is notable for its use of XOR-obfuscated C2 traffic that mimics development activity by using source-code-like file extensions (.cs, .go, .rs). Because the victim authenticates directly with Microsoft, security measures like FIDO2 passkeys and standard MFA are bypassed as the identity provider views the session as legitimate. The operator harvests access and refresh tokens, often establishing persistence through rogue device registration within minutes of the initial compromise.
This threat is particularly dangerous for organizations relying solely on identity alerts, as the initial stages generate no identity-side warnings. The first evidence of intrusion often only appearing during token replay or lateral movement from a divergent network. The most effective mitigation is the implementation of Conditional Access policies to restrict or block the device code flow globally.