To the person who reaches it, the last page looks like a routine Adobe document step built around a short sign-in code. To a security scanner following the same link, that page may never appear.

Researchers at the malware sandbox ANY.RUN found that Wazza, a new phishing kit, screens every visitor before it decides what to show (The Hacker News). It is the latest kit built on device code phishing, a technique that turns Microsoft's own sign-in page into the place where an account is handed over.

A legitimate sign-in, turned around

How the flow is meant to work

The OAuth 2.0 device authorization grant, defined in RFC 8628, exists for devices that can't easily show a browser, such as smart TVs or command-line tools. The device asks the identity provider for a short code, and the user types that code on a sign-in page on another device to approve the connection.

How attackers run it in reverse

In device code phishing, the attacker requests the code and persuades the victim to enter it on the real Microsoft sign-in page. The victim's approval hands the attacker's session access and refresh tokens. No password changes hands, and any multifactor prompt has already been passed by the victim.

The same mechanism sat behind Kali365 and the AI-automated campaign we covered in GTG-20006. What is new in Wazza is the screening in front of it.

Four checks before the lure

Wazza decides, step by step, whether a visitor is worth showing the lure to. According to the analysis reported by The Hacker News, the chain starts at a wildcard landing domain, boegl-krysl[.]eu, which calls /api/wazza-config to check whether the hostname belongs to an active campaign.

A Cloudflare Workers subdomain issues a client marker that can correlate the visit, /api/mint-token creates a short-lived signed session token, and check.boegl-krysl[.]eu validates that token together with browser telemetry. Only visitors who clear every step continue through /r and /meline to the final page.

Why standard controls miss it

Wazza treats a scanner differently from a person. A request without a validly minted token, or without the expected browser telemetry, can be filtered out at the anti-bot gate, so automated security systems may receive different content from a human visitor (The Hacker News). An analyst who can't reproduce the full chain may close the case as clean.

Even a full reproduction leaves one blind spot. The code is entered on Microsoft's own sign-in page, so advice to check the URL before signing in does not help: the domain the victim checks is genuine.

How Aegis protects against it

Aegis does not classify infrastructure. It classifies intent. A lure with no attacker-owned infrastructure still has to ask the recipient to do something on the attacker's behalf, and that request is what gets classified, independent of how clean the destination URL is.

AegisAI's agents evaluate the message and the destination it points to together, and pull a malicious message out of mailboxes before users see or click it. More on how that works: inbound email security.

How Wazza fits the device code wave

Wazza is one of many. BleepingComputer reports a 37x surge in device code phishing pages detected by researchers and lists at least 11 kits that now offer the technique as a ready-made service.

The lures look alike, too. The kits in that report dress their pages as Adobe, DocuSign, SharePoint, Microsoft Teams and Microsoft 365 sign-in steps, the same kind of routine document request Wazza uses. Treat any unexpected request to enter a code as suspicious, whatever brand it wears.

What the reporting does not tell us

Delivery. The coverage we reviewed does not say how victims first receive the link, so the email lure itself is unknown.

Scale. No victim or campaign counts were published, only the targeted sectors and regions.

Indicators age fast. The domains below were captured at analysis time. Kits like this rotate infrastructure quickly, so absence from logs is not proof of absence.

MITRE ATT&CK mapping

Recommendations for defenders

Indicators of compromise

FAQ

References