KeyStealth Hid in a Microsoft 365 Inbox for Seven Weeks, MFA and All
ADAMnetworks details how a device code phishing kit let an operator register rogue Entra devices, sit in a company's Microsoft 365 account for seven weeks and attempt payment fraud.
A phishing crew used a fake quote request to take over a US construction-bid company’s Microsoft 365 account, hold it for seven weeks, and then try to redirect a customer payment, ADAMnetworks reports. The researchers call the operator KeyStealth. Its rogue devices were named iAuthFlow-Device, which ties it to the iAuthFlow phishing-as-a-service kit. Citing Abnormal’s August research, ADAMnetworks says that kit sells on a Russian-language forum for $10,000. Responders disabled the account about 12 minutes after the operator set up its payment trap, and no payment details went out.
For defenders
Access: A “Re: Request for Quote” email, sent from a compromised third-party mailbox, linked through i-ps-c[.]com to bnkcontract[.]cam, with a decoy page shown to scanners (T1566.002 (Phishing: Spearphishing Link)). The victim entered a password and approved MFA, and the operator collected tokens through the OAuth device code flow using the Microsoft Authentication Broker client ID. ADAMnetworks counted 209 of 211 later sign-ins carrying the device code marker.
Persistence: Within 22 seconds of getting the token, the operator registered two Entra devices, and added a third 19 days later with no user sign-in. All reported OS version 10.0.19041.928, the ROADtools default. Those devices let the operator mint primary refresh tokens, the long-lived Windows single sign-on token. That’s T1098.005 (Account Manipulation: Device Registration) and T1550.001 (Use Alternate Authentication Material: Application Access Token). A passkey was also added but never used.
BEC: On Oct. 15 the operator set up an inbox rule named . that hid a customer’s replies, offered same-day ACH or Venmo payment, then deleted the sent copy (T1564.008 (Hide Artifacts: Email Hiding Rules)).
Hunt: Look for Entra “Add device” events with that name or OS version, device code sign-ins to app ID 29d9ed98-a469-4536-ade2-f981bc1d605e, device registration within minutes of a Broker sign-in, and one-character rules moving mail to Conversation History. Block device code flow with a Conditional Access authentication flows policy wherever it isn’t needed.
i-ps-c[.]com
bnkcontract[.]cam
kinsleyconstructions[.]us
wmmeagency[.]cam
37.148.203[.]226What it means for you
This attack beats MFA instead of guessing passwords. The victim signed in and approved the MFA prompt themselves, and that handed the attacker a pass that kept working for weeks. Then they wait quietly in your email until there’s money to redirect. If a customer or supplier suddenly gets “new payment details” from you, that should be checked by phone.
Do this now
- Treat any emailed “quote,” “invoice” or “PDF” link that asks you to sign in to Microsoft as suspect, even when it comes from a contact you know. Their mailbox may be the compromised one.
- In Microsoft 365, check Entra for devices you don’t recognize and review inbox rules on finance and sales mailboxes.
- If you find a rogue device, disable the account and revoke sessions first, then delete the device, remove unknown sign-in methods, and reset the password.
- Confirm any payment-change request with a phone call to a number you already have.