Storm-2372: Device-Code Phishing That Walks Around MFA

Storm-2372 is Microsoft’s designation for a threat cluster running a device-code phishing campaign that steals Microsoft 365 and Entra ID access by abusing the OAuth 2.0 device authorization grant flow — not any product vulnerability. The attacker starts a legitimate device-code sign-in, then talks the victim into entering the attacker-supplied code on Microsoft’s own sign-in page. When the victim authenticates, the attacker’s device receives valid access and refresh tokens, effectively walking around password and MFA prompts because the victim completed the real authentication. Microsoft’s July 2026 update assesses Storm-2372 as an initial-access sub-cluster of Midnight Blizzard (APT29 / Cozy Bear, linked to Russia’s SVR).

Overview

Microsoft published its report on Storm-2372 on 13 February 2025, describing activity active since August 2024. The campaign is identity-centric and malware-light: the payload is stolen tokens, not a binary. Microsoft assesses with moderate confidence that the activity aligns with Russian state interests based on victimology and tradecraft, and the 31 July 2026 update ties the cluster to Midnight Blizzard.

How the Campaign Works

• Rapport. The actor impersonates a prominent or relevant person and opens contact over WhatsApp, Signal or Microsoft Teams. T1566.003
• Lure. The target receives an invite to a fake meeting or event that mimics a messaging or meeting experience.
• Device-code generation. In parallel, the actor initiates a legitimate device-code authentication request against Microsoft, producing a short-lived device code.
• Code entry. The lure instructs the victim to enter the actor-supplied code — framed as a meeting ID — on the genuine device-login page.
• Token capture. The victim authenticates with password and MFA; the actor’s device receives valid access and refresh tokens. T1528 T1550.001
• Mail collection. The actor uses Microsoft Graph to search mailboxes for keywords such as username, password, admin, credentials and secret, and exfiltrates matching mail. T1114.002
• Spread. The actor sends further device-code links to other users from the compromised account.

Targeting

Microsoft reports targeting across government, NGOs, IT services and technology, defense, telecommunications, health, higher education, and energy and oil and gas, with victims in Europe, North America, Africa and the Middle East. Microsoft did not publish specific victim counts, and none are claimed here.

MITRE ATT&CK Mapping

Detection Signals

Microsoft did not publish IPs, domains or hashes for this campaign; hunt on identity telemetry.

• Sign-in telemetry showing the device-code flow to microsoft.com/devicelogin and login.microsoftonline.com/common/oauth2/deviceauth.
• Entra sign-in error code 50199 followed by a successful sign-in within roughly five minutes — user hesitation, then completion of the prompt.
• Unexpected device-registration events close in time to anomalous token or Primary Refresh Token activity.
• Anomalous Microsoft Graph mail-search activity shortly after a successful device-code sign-in.
• Risky sign-ins flagged by Entra ID Protection, including anonymised IP address and threat-intelligence detections.

Detection & Mitigation

• Block the device-code flow via Conditional Access where it is not required; where it is, scope it tightly.
• Require phishing-resistant MFA — FIDO2 security keys or passkeys — and block legacy authentication and telephony-based MFA.
• Enable Continuous Access Evaluation so high-risk sessions are revoked or re-authenticated promptly.
• Restrict device registration in Entra ID and alert on registrations near suspicious token activity.
• On suspected compromise, revoke refresh tokens and force re-authentication; review Graph mailbox access.
• Educate users that a code someone sends them is never a meeting ID to be entered on a sign-in page.