--- title: "In three of these campaigns, the common point was abuse of Microsoft's Device Code Authentication,… — intsec — DecisionGateway" description: "allegation by intsec, recorded 2026-11-06 — verbatim quote and source citation." canonical_url: "https://dgw.tmarket.io/claims/01a1d29f-8ecc-7ce9-b66d-adfe6f873101" meta: "og:description": "allegation by intsec, recorded 2026-11-06 — verbatim quote and source citation." "og:image": "https://dgw.tmarket.io/og.jpg" "og:image:alt": "White network of connected nodes crossed by a timeline on black" "og:image:height": "1024" "og:image:width": "1024" "og:title": "In three of these campaigns, the common point was abuse of Microsoft's Device Code Authentication,… — intsec — DecisionGateway" "twitter:image": "https://dgw.tmarket.io/og.jpg" --- > Index of every page on this site: [llms.txt](https://dgw.tmarket.io/llms.txt) allegationSaid on 2026-11-06 # **In three of these campaigns, the common point was abuse of Microsoft's Device Code Authentication, a method by which an attacker, by deceiving the user, can gain access to their Microsoft 365 account without stealing a password and even while directly bypassing MFA.** A allegation by [**intsec**](https://dgw.tmarket.io/actors/01a1d54a-5d87-7e60-9d71-1e7a395120c4), said on 2026-11-06. Statements are as reported by the cited publishers — not verified by DecisionGateway. > *نکته مشترک در سه مورد از این کمپینها، سوءاستفاده از قابلیت Device Code Authentication مایکروسافت بود؛ روشی که مهاجم با فریب کاربر میتواند بدون سرقت گذرواژه و حتی دور زدن مستقیم MFA، به حساب Microsoft 365 او دسترسی پیدا کند.* intsecPublished 2026-11-06 [ Read source](https://t.me/intsec/7767) [**intsec dossier **](https://dgw.tmarket.io/actors/01a1d54a-5d87-7e60-9d71-1e7a395120c4) ## **Discussion** ## **Related claims** [**Fake versions of tools such as ChatGPT and Claude were used to steal users' login information and session cookies.**intsec · allegation](https://dgw.tmarket.io/claims/01a1d29f-8ed4-764c-89bb-1ee6ea7ee9f2) [**For security teams, the message of this report is clear: merely protecting passwords and endpoints is not enough; control of authentication processes, active sessions, and changes to defensive tool settings must also be taken seriously.**intsec · statement](https://dgw.tmarket.io/claims/01a1d29f-8ee2-73e5-a82d-7b631fa29a15) [**In October 2026, five active cyber campaigns targeted American organizations, focusing on stealing corporate identity, sensitive information, and weakening defensive tools.**intsec · allegation](https://dgw.tmarket.io/claims/01a1d29f-8ec2-7213-82b8-0d3276820638) [**Clicking the link in the email is not required; no authentication is required, no user interaction is needed, and MFA does not help.**turansecurity · allegation](https://dgw.tmarket.io/claims/01a1d0db-47a4-7e21-8d4f-0f8642a6061a) [**Malicious programs can bypass protection and gain access to passwords, private keys and seed phrases of crypto wallets.**Binance · allegation](https://dgw.tmarket.io/claims/01a1d76c-3c90-732d-b913-05281f746309) [**WKLP malware, by manipulating Microsoft Defender settings, stopping security processes, and stealing information, provides the attacker with the ability to persist on the system.**intsec · allegation](https://dgw.tmarket.io/claims/01a1d29f-8edb-7aea-af65-bce88dcf7669) ## **More claims by intsec** [**The rumor of a cyber attack on the capital's electricity network is rejected.**denial](https://dgw.tmarket.io/claims/01a1d2a8-0275-7c1f-9742-a6dc5195aa4a) [**A news report was published claiming that cyber attacks on Tehran's electricity network had begun.**statement](https://dgw.tmarket.io/claims/01a1d2a8-026a-7082-b51b-52ca1db7816a) [**The full RedShell article examines all five campaigns and countermeasures against them.**statement](https://dgw.tmarket.io/claims/01a1d29f-8ee9-7626-93b6-c3127c490697) [**For security teams, the message of this report is clear: merely protecting passwords and endpoints is not enough; control of authentication processes, active sessions, and changes to defensive tool settings must also be taken seriously.**statement](https://dgw.tmarket.io/claims/01a1d29f-8ee2-73e5-a82d-7b631fa29a15) [**WKLP malware, by manipulating Microsoft Defender settings, stopping security processes, and stealing information, provides the attacker with the ability to persist on the system.**allegation](https://dgw.tmarket.io/claims/01a1d29f-8edb-7aea-af65-bce88dcf7669) [All claims by intsec](https://dgw.tmarket.io/claims?claimant_id=01a1d54a-5d87-7e60-9d71-1e7a395120c4) [All claims](https://dgw.tmarket.io/claims) ```json {"@context":"https://schema.org","@graph":[{"@id":"https://dgw.tmarket.io/#website","@type":"WebSite","description":"Decisions, events and falsifiable forecasts from 4,000+ Telegram channels — every claim cited. Read free.","name":"DecisionGateway","url":"https://dgw.tmarket.io/","publisher":{"@id":"https://dgw.tmarket.io/#identity"}},{"@id":"https://dgw.tmarket.io/claims/01a1d29f-8ecc-7ce9-b66d-adfe6f873101#webpage","@type":"WebPage","description":"allegation by intsec, recorded 2026-11-06 — verbatim quote and source citation.","name":"In three of these campaigns, the common point was abuse of Microsoft's Device Code Authentication,… — intsec — DecisionGateway","url":"https://dgw.tmarket.io/claims/01a1d29f-8ecc-7ce9-b66d-adfe6f873101","breadcrumb":{"@id":"https://dgw.tmarket.io/claims/01a1d29f-8ecc-7ce9-b66d-adfe6f873101#breadcrumb"},"isPartOf":{"@id":"https://dgw.tmarket.io/#website"},"potentialAction":[{"@type":"ReadAction","target":["https://dgw.tmarket.io/claims/01a1d29f-8ecc-7ce9-b66d-adfe6f873101"]}]},{"@id":"https://dgw.tmarket.io/#identity","@type":"Organization","name":"DecisionGateway","url":"https://dgw.tmarket.io"},{"@id":"https://dgw.tmarket.io/claims/01a1d29f-8ecc-7ce9-b66d-adfe6f873101#breadcrumb","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","name":"Home","item":"https://dgw.tmarket.io","position":1},{"@type":"ListItem","name":"Claims","item":"https://dgw.tmarket.io/claims","position":2},{"@type":"ListItem","name":"In three of these campaigns, the common point was abuse of…","position":3}]},{"@id":"https://dgw.tmarket.io/claims/01a1d29f-8ecc-7ce9-b66d-adfe6f873101#/schema/quotation/1","@type":"Quotation","dateCreated":"2026-11-06","isBasedOn":"https://t.me/intsec/7767","text":"نکته مشترک در سه مورد از این کمپینها، سوءاستفاده از قابلیت Device Code Authentication مایکروسافت بود؛ روشی که مهاجم با فریب کاربر میتواند بدون سرقت گذرواژه و حتی دور زدن مستقیم MFA، به حساب Microsoft 365 او دسترسی پیدا کند.","url":"/claims/01a1d29f-8ecc-7ce9-b66d-adfe6f873101","spokenByCharacter":{"@type":"Person","name":"intsec","@id":"/actors/01a1d54a-5d87-7e60-9d71-1e7a395120c4"}}]} ``` ## Sitemap See the full [sitemap](https://dgw.tmarket.io/sitemap.md) for all pages.