hxxps://login.microsoftonline[.]com/common/oauth2/deviceauthURL
Reported by 1 independent source · first reported by Volexity · last reported
Last reported 20 months ago
What the reports say
1 report, newest first · the exact sentence from each-
Multiple Russian Threat Actors Targeting Microsoft Device Code Authentication“In fact, all hyperlinks in the email were linked to hxxps://login.microsoftonline[.]com/common/oauth2/deviceauth, the page used for the Microsoft Device Code authentication workflow.”
Indicators reported together
named in the same reports- sen-comms[.]comin 1 report
- 107.189.27[.]41in 1 report
- afpi-sec[.]comin 1 report
- 144.172.113[.]77in 1 report
- chromeelevationservice[.]comin 1 report
- 167.88.162[.]72in 1 report
- comms-net[.]comin 1 report
- 107.189.26[.]199in 1 report
- connect-71q.pages[.]devin 1 report
- rosejob[.]comin 1 report
- hxxps://aka[.]ms/deviceloginin 1 report
Copy these 11 indicators · defanged
Thanks — we review every report.