Trusted Login, Stolen Session

Authors: Nitish Singh, Nikhil Kumar Chadha, and Tanmay Kumar 

Trusted Login, Stolen Session

AI-accelerated phishing beyond the inbox

Attackers are using AI to improve targeting, automate infrastructure, and exploit trusted brands. Device-code phishing shows the more important shift: the target is no longer only the password. It is an authenticated cloud session. 

Executive Brief:

Threat snapshot:

The figures above come from different data sets and measure different outcomes. They should not be combined into a single prevalence estimate.

Key Judgments:

1. Executive Summary:

Artificial intelligence is changing the economics and delivery of phishing more than the underlying mechanics. The core techniques remain largely the same, including urgency, authority, trusted brands, redirect chains, and user interaction. AI can reduce the effort required to research targets, tailor lures, generate message variations, update infrastructure, and adapt campaigns across different communication channels. 

A reported 2026 campaign involving the EvilTokens phishing-as-a-service toolkit illustrates how this can work in practice. The campaign used role-specific lures and dynamically generated OAuth device codes. Victims completed authentication through a legitimate Microsoft device login page, while the authentication flow ultimately authorized a session controlled by the attacker. This allowed the operators to obtain valid access tokens without directly collecting the user's password. 

After obtaining access, the operators validated the tokens, queried Microsoft Graph, identified users and permissions, searched mailboxes, and created inbox rules. In some cases, a device was registered and a Primary Refresh Token was obtained within minutes. This reduced the time between the initial phishing interaction and access to cloud resources. 

Other observed campaigns have used well-known AI brands as the lure. Examples included impersonating ChatGPT and Claude, promoting a fake AI-related Windows plugin through malvertising, and creating a fraudulent DeepSeek V4 repository on GitHub. The intended outcomes varied, including payment card theft, possible token interception, and malware delivery. The common approach was to use familiar branding, trusted services, and user interaction to make the activity appear legitimate. 

Threat actors are also extending these techniques into live communications. Reporting on activity attributed to a North Korean group described the use of deepfake audio and video during Zoom calls to impersonate company executives and persuade technology employees to download malicious code. This demonstrates how AI-enabled social engineering can extend beyond email and static messaging into more interactive scenarios where the victim is expected to respond in real time. 

2. Phishing has moved beyond the inbox:

TechRadar cited data from KnowBe4 indicating that 86% of phishing activity in its analyzed dataset was AI-driven, with AI-assisted campaigns estimated to be roughly seven times more efficient than manually produced attacks. The same reporting noted increases in several phishing techniques over the preceding six months, including a 49% rise in calendar invite phishing, a 41% increase in Microsoft Teams-related attacks, and a 139% increase in reverse-proxy activity targeting Microsoft 365 credentials. These figures indicate broader adoption of AI-assisted phishing and continued growth in techniques designed to capture cloud credentials.

Where AI changes the attacker workflow:

3. Case study: Dynamic device-code phishing:

The OAuth 2.0 device authorization flow is intended for devices that cannot support a standard interactive login, such as shared displays or embedded devices. The user is provided with a short code and enters it through a browser on another device. From a security perspective, the flow provides weaker binding between the device that initiated the request and the subsequent authentication session.

In the observed campaign, the attacker initiated the device authorization flow and presented the generated code through a phishing page. The victim then completed authentication through the legitimate Microsoft device login page. This allowed the attacker to obtain access to the authenticated session without needing to replicate the legitimate sign-in page or directly capture the user's password. The victim effectively authorized the attacker's session by entering the provided code and approving the authentication request.

Technical markers and post-compromise behavior:

Markers in the observed chain:

Observed post-compromise objectives:

4. Case study: AI brands as bait: 

Multiple campaigns have used AI-related branding as a social engineering lure without evidence that the referenced AI services themselves were compromised. The observed activity relied on established phishing techniques while using familiarity and growing interest around AI products to increase the credibility of the lures.

Reported outcomes included payment card theft, possible authentication token interception, and delivery of information-stealing malware. From a CTI perspective, the use of AI branding appears to be primarily a trust and delivery mechanism rather than evidence of compromise of the underlying AI services.

5. Deepfake social engineering reaches live meetings: 

The Financial Times reported that the North Korean group PutridSlug used deepfake video and audio during Zoom calls to impersonate company executives. In the reported case, technology employees were persuaded to download malicious code, which was then used for financial theft.

The activity shows how threat actors can extend established social engineering techniques into live interactions. By combining impersonation with realistic audio and video, attackers can reinforce the appearance of authority and create a more convincing context for the requested action.

Deepfake detection can support the triage of suspicious audio or video, but it should not be treated as the primary control. Detection results can vary, and even legitimate accounts or meeting invitations may be compromised. A stronger defensive measure is to require independent verification through a separate trusted channel before approving sensitive actions, particularly when the request involves downloading software, sharing credentials, transferring funds, or making other security-sensitive changes.

6. Securonix Threat Labs Summary:

Securonix Threat Labs assesses with high confidence that AI is increasingly being used by threat actors to improve the speed and scale of phishing operations. The primary changes are in how quickly attackers can conduct target research, personalize lures, generate convincing impersonation content, and adapt campaigns to specific organizations, industries, and current events. The underlying techniques remain familiar, including phishing, social engineering, credential theft, and session hijacking, but AI can make these activities faster and easier to scale.

The activity reviewed in this report shows that the risk extends beyond email. Attack chains can span email, collaboration platforms, cloud infrastructure, legitimate authentication services, AI-related branding, and post-authentication automation. For this reason, defensive monitoring should correlate identity, email, SaaS, cloud, endpoint, browser, calendar, and collaboration telemetry rather than analyzing each source independently. The relationships between these events can provide stronger evidence of malicious activity.

Device-code phishing is a notable example. In this technique, the adversary does not necessarily bypass the victim's MFA mechanism. Instead, the victim completes a legitimate authentication process while unknowingly authorizing a session initiated by the attacker. This distinction is important when evaluating detection and prevention coverage. Phishing-resistant MFA remains an important control, but it does not by itself eliminate the risk of device-code abuse. Where operational requirements allow, organizations should consider restricting device-code authentication and applying tighter controls to approved exceptions.

Detection should focus on the sequence of related events rather than individual indicators. A device-code prompt, unfamiliar IP address, or isolated authentication event may have a legitimate explanation. Stronger evidence comes from correlating a suspicious message or URL interaction with device-code authentication, token activity from unfamiliar infrastructure, Microsoft Graph or mailbox access, and follow-on persistence such as inbox-rule creation or device registration. A combination of these events occurring within a short timeframe provides greater confidence than any single alert.

The reviewed activity also shows a consistent trust-abuse pattern. Malicious content does not always need to be technically complex when the surrounding workflow appears legitimate. Threat actors can combine recognizable AI or enterprise brands with legitimate hosting platforms, authentic authentication pages, signed software, trusted cloud services, or routine user actions. This can reduce the effectiveness of controls that rely only on reputation or URL characteristics and increases the value of behavioral and identity-based detection.

Deepfake-enabled social engineering follows a similar pattern. Synthetic audio or video is primarily useful when it makes a requested action appear more credible. That action may involve entering a code, opening a link, approving a payment, sharing credentials, or executing software. Investigations should therefore examine both the authenticity of the media and the requested action, along with the technical activity that follows the interaction.

Statistics relating to AI-enabled phishing should also be interpreted in context. The reporting cited in this assessment states that AI was associated with 86% of phishing activity in a specific analyzed dataset and estimates that AI-assisted campaigns may be approximately seven times more efficient than manually produced campaigns. These figures provide an indication of activity within the methodology and dataset used by the reporting source. They should not be treated as universal measurements of phishing activity across the broader threat environment.

From a defensive standpoint, the priority is to limit the ability of a convincing lure to result in a durable authenticated session. Organizations should consider restricting device-code authentication where feasible and support that control with phishing-resistant MFA, conditional access, URL analysis at interaction time, session and token monitoring, detection of unusual Graph and mailbox activity, and rapid investigation of new inbox rules or device registrations. Email security and user awareness remain important, but identity-centric monitoring is needed to track activity after the initial phishing interaction.

A useful hunting pattern is the progression of related events: 

Message or URL interaction -> device-code authentication -> token use from unfamiliar infrastructure -> Graph or mailbox access -> inbox-rule creation or device registration

Securonix Threat Labs assesses that correlating this sequence across identity and cloud telemetry can provide stronger detection opportunities for AI-assisted phishing and session hijacking before an initial interaction develops into persistent cloud-account access.

7.Detection and hunting priorities: 

The following detection opportunities are intended for prioritization and may require adjustment before deployment. Field names and event availability can vary depending on the log source, license, and retention period. Each analytic should be tuned against known device-code authentication activity and normal administrative workflows before being used for enforcement.

Recommended hunt sequence:

• Begin the investigation with device-code authentication and suspicious URL-click activity, then pivot to token usage, Graph API activity, mailbox access, device registration, and any follow-on phishing activity. 

• Identify all accounts that received the same lure, interacted with the same redirect infrastructure, or authenticated from the same polling infrastructure. 

• Avoid blocking shared cloud infrastructure based only on an IP or hosting provider referenced in this report. Treat such indicators as supporting context and correlate them with observed behavior and timing. 

• Preserve relevant email, browser, Entra, Exchange, endpoint, and cloud audit data before removing inbox rules, registered devices, applications, or other artifacts. 

Appendix A: Indicators of compromise

Appendix B: MITRE ATT&CK mapping

References:

[1] CrowdStrike. "2026 CrowdStrike Global Threat Report: AI Accelerates Adversaries and Reshapes the Attack Surface." February 24, 2026. 

[2] Microsoft Defender Security Research Team. "Inside an AI-enabled device code phishing campaign." April 6, 2026. 

[3] Microsoft Threat Intelligence and Microsoft Defender Security Research Team. "AI brands as bait: How threat actors are using the AI hype in social engineering." June 8, 2026. 

[4] Financial Times. "AI supercharges the cyber hacker's toolkit." July 20, 2026. 

[5] Craig Hale, TechRadar. "The inbox is no longer the only front line: Report claims vast majority of phishing attacks are now generated by AI." May 4, 2026.