vscode-redirect.azurewebsites[.]netDomain
Reported by 2 independent sources · first reported by Volexity · last reported
Last reported 15 months ago
What the reports say
2 reports, newest first · the exact sentence from each-
Microsoft Entra ID OAuth Phishing and Detections“Redirect URIs were for legitimate MSFT domains (insiders.vscode.dev or vscode-redirect.azurewebsites[.]net)”
-
Phishing for Codes: Russian Threat Actors Target Microsoft 365 OAuth Workflows“…lient_id=aebc6443-996d-45c2-90f0-388ff96faa56&resource=hxxps://graph.microsoft.com&response_type=code&redirect_uri=hxxps://vscode-redirect.azurewebsites[.]net&login_hint=<removed>&ui_locales=en-US&mkt=en-US&client-request-id=<removed>”
Indicators reported together
named in the same reports- hxxps://login.microsoftonline[.]com/organizations/oauth2/v2.0/authorize?state=https://mae.gov.ro/in 2 reports
- insiders.vscode[.]devin 2 reports
- hxxps://login.microsoftonline[.]com/common/oauth2/authorize?redirect=https://zoom.us/j/in 1 report
- usesinsiders.vscode[.]devin 1 report
- hxxp://127.0.0[.]1:9217/callback?code=1.ARsAIGLD9ki0FE63WmhS-KbgFENkvK5tmXin 1 report
- hxxps://login.microsoftonline[.]com/common/oauth2/authorize?url=https://teams.microsoft.com/in 1 report
- address[.]herein 1 report
- hxxps://login.microsoftonline[.]com/WebApp/CloudDomainJoin/8?code=in 1 report
- hxxps://login.microsoftonline[.]com/organizations/oauth2/v2.0/authorize?state=in 1 report
- hxxps://insiders.vscode[.]dev/redirectin 1 report
- hxxps://login.microsoftonline[.]com/common/oauth2/authorize?redirect=in 1 report
- hxxps://login.microsoftonline[.]com/organizations/oauth2/v2.0/tokenin 1 report
- azure.signinlogs[.]propertiesin 1 report
- hxxps://login.microsoftonline[.]com/WebApp/CloudDomainJoin/8in 1 report
- azure.auditlogs[.]propertiesin 1 report
- hxxps://dirkjanm[.]io/abusing-azure-ad-sso-with-the-primary-refresh-token/in 1 report
- dirkjanm[.]ioin 1 report
- hxxps://posts.specterops[.]io/requesting-azure-ad-request-tokens-on-azure-ad-joined-machines-for-browser-sso-2b0409caad30in 1 report
- posts.specterops[.]ioin 1 report
Copy these 19 indicators · defanged
Thanks — we review every report.