Threat feed

Wazza device-code phishkit

Wazza phishkit: staged routing and document-verification device-code phishing against Microsoft 365

Posted · Updated · Spectrum Delta Research Team

Summary

LevelBlue SpiderLabs (Oct 20, A/2) documents Wazza, a newly observed multi-stage phishing kit active since at least early July 2026 that targets Microsoft 365 accounts with device-code phishing — the kit presents Microsoft's device code as a 'document verification code' inside Adobe- and Microsoft-branded document pages, so the victim authorizes the attacker's OAuth client through Microsoft's legitimate device-authorization flow rather than typing a password into a fake form. The kit wraps the final page in staged routing with anti-automation browser checks, making the initial link uninformative to URL reputation and automated scanning.

Breakdown

Adversary

Unknown — the primary provides no attribution to a named threat actor

Procedures (3)

  1. PDF lure from compromised accounts to staging chain

    Spearphishing attachment: branded PDF lures from compromised senders

    Logs

    • Email gateway · Business-themed PDFs; compromised senders; SharePoint-branded links
    • Web proxy / DNS · Redirect chains; workers.dev subdomains; .eu domains; Wazza API paths

    Detectors

    No known detector

Click to expand remaining (2) procedures

  1. Staged routing with anti-automation browser checks

    Spearphishing link: campaign routing and anti-automation filtering

    Logs

    • Web proxy / DNS · Redirect chains; workers.dev subdomains; .eu domains; Wazza API paths

    Detectors

    • Wazza Phishkit HTTP activity (SID 84004715) · HTTP activity tied to the kit's Device Code flow

  2. Device code presented as document verification

    Device-code phishing as document verification

    Logs

    • Web proxy / DNS · Redirect chains; workers.dev subdomains; .eu domains; Wazza API paths
    • Entra sign-in logs · Device-code flow authentications (flow evidence, not phishing proof)

    Detectors

    No known detector

Indicators of compromise

Hunt only

(LevelBlue (https://www.levelblue.com/blogs/spiderlabs-blog/inside-wazza-a-newly-observed-device-code-phishing-kit-targeting-microsoft-365-accounts), A/2; ANY.RUN (https://thehackernews.com/2026/10/wazza-phishkit-targets-banking.html), B/2) — beacon domains beacon-surge-sync[.]beacon-surge-sync[.]workers[.]dev and beaconoflinenew[.]lastfightlink[.]workers[.]dev; Google Sites staging URLs (sites[.]google[.]com/view/ plus randomized view IDs such as securespdf, adobe-docus, miticabo); phishing infrastructure across ~25 .eu domains (boegl-krysl[.]eu, hutspotmaken[.]eu, beton-beton[.]eu, dymowski[.]eu, and others) plus hacsg[.]com and electroloys[.]com; Cloudflare Workers final pages with long randomized m365-themed subdomains; Wazza API endpoints /api/wazza-config, /api/mint-token, /api/fire-mint, /api/klam-kadity, /api/queltz-narvik, /bb-landing, /api.php?svc=; routing subdomains check/id/gate (wave 1) and portal/hub/svc (wave 2); redirect paths /r?key=, /meline, /onlsbdmn, /onfqdn, /eprfx, /prfxmsmach; URL parameters tok, tgm, m, tg, thm, ch; final-page service values svcm/svco/svcd; decoy sites Veltmann & Cie., Kellner & Brandt, Praevita Klinik, Arenberg Residences, Taktiv, Nordlys Energy. Assessed 2026-10-24, hunt-only — the domains and staging URLs are perishable campaign infrastructure; the durable hunt value is the behavioral chain (PDF-lure-to-staging-to-checked-final-page routing, the Wazza API path set, and device-code authentications following lure clicks).

Detailed

Beacon domains: beacon-surge-sync[.]beacon-surge-sync[.]workers[.]dev; beaconoflinenew[.]lastfightlink[.]workers[.]dev. Google Sites staging: sites[.]google[.]com/view/ with randomized view IDs (hgfdsqazxcvhjoswwqq, adobe-docus, miticabo, ctfvygbuhgyftvbgyfpoiuytrftgyh, kjvcfdswqazxcfvghjoplkjmnbvcf, securespdf, onwajuly). Preloader resource: fgwhjmdaurspxvznk[.]hutspotmaken[.]eu/B4fWRuA. Phishing domains: boegl-krysl[.]eu (wildcard landing), hutspotmaken[.]eu, beton-beton[.]eu, bike-msca[.]eu, bodi-project[.]eu, bruoth-family[.]eu, cardamomo[.]eu, coppietersrecherche[.]eu, diabetesnet[.]eu, dymowski[.]eu, euniverza[.]eu, illuminatedminds[.]eu, jetcapital[.]eu, languagesforwork[.]eu, lesbolides[.]eu, mdiament[.]eu, nbi-training[.]eu, nellarmonia[.]eu, originalpizza[.]eu, polskaprezydencjacsr[.]eu, robologic[.]eu, safetystock[.]eu, electroloys[.]com, hacsg[.]com. Final landing pages (Cloudflare Workers, long randomized subdomains): dv0psh-purv3w-azfn-b2c0-msauth3-m365svc-s3ntln-4zrfn3x-cntnrx[.]workers[.]dev; ssosvc-m365s-kvl-dv0pshb-s3ntln-c0mply-4zrmonx-apimgwx-evnthb[.]workers[.]dev; wndws-pip3ln-sql3-waf3-purv3-gdprsx-dfn-azfn-appsvc-0ffapx[.]workers[.]dev; purv3w3-t3ms4pp-certs-intun3-sbussvx-4zredg-siemsv-pip3ln-0ffc3[.]workers[.]dev; and others. API paths: /api/wazza-config, /api/mint-token, /api/fire-mint, /api/klam-kadity, /api/queltz-narvik, /bb-landing, /api.php?svc=. Routing subdomains: check, id, gate (wave 1); portal, hub, svc (wave 2). Redirect paths: /r?key=, /meline, /onlsbdmn, /onfqdn, /eprfx, /prfxmsmach. URL parameters: tok, tgm, m, tg, thm, ch. Service values: svcm, svco, svcd. Decoy sites: Veltmann & Cie., Kellner & Brandt, Praevita Klinik, Arenberg Residences, Taktiv, Nordlys Energy. Campaign window: at least early July 2026 through publication. All from the primary (LevelBlue (https://www.levelblue.com/blogs/spiderlabs-blog/inside-wazza-a-newly-observed-device-code-phishing-kit-targeting-microsoft-365-accounts), A/2, Oct 20 2026) with the ANY.RUN wave-1 chain detail (ANY.RUN (https://x.com/anyrun_app/status/2102745165915996562), B/2, Sept 23 2026), assessed 2026-10-24, hunt-only.

Sources

Grades are source reliability (A–F) and information credibility (1–6).

Questions, detections or sightings of Wazza device-code phishkit? Bring them to the community.

Discuss in the Tradecraft Slack