# OAuth consent phishing via relayed flow

Real IdP login relayed through attacker infrastructure; post-MFA tokens land with the attacker

_Area: Web authentication and account takeover. Seen in 3 disclosed reports; latest 2026-09-02. Updated 2026-11-02._

## How it works
OAuth/OIDC login and consent assume the user authenticates at the real identity provider and the resulting code or token returns to the requesting app. The broken assumption is that the browser talking to the IdP is the user's own browser and that the redirect target is the legitimate app. When an attacker sits between victim and IdP — a reverse proxy, a device-code relay, or a redirect chain ending on a real authorize page — the genuine MFA challenge still completes, but the post-MFA session token, refresh token, or authorization code is delivered to attacker-controlled infrastructure. The IdP sees a valid login; the user sees a real login page. Nothing in the credential or MFA check distinguishes the two.

## Where it shows up
- Phishing that asks the victim to paste a device-auth code into Microsoft's real login, or to "copy and send the exact URL" from the browser [E2](https://bugbountylibrary.com/r/blog%3Avolexity-com-blog-2025-12-04-dangerous-invitations-russian-threat-actor-spoofs-european-security-events-in-targeted-phis.md)[E3](https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-inside-knight-office-m365-aitm-attack.md).
- Post-MFA token events to Microsoft Authentication Broker or Graph from a different ASN than the initial sign-in [E1](https://bugbountylibrary.com/r/blog%3Aelastic-co-security-labs-threat-command-tycoon-2fa-aitm-detection-engineering.md)[E3](https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-inside-knight-office-m365-aitm-attack.md).
- Device registration or WHfB key enrollment with non-native user agents (e.g. axios) or from cloud-VPS addresses [E1](https://bugbountylibrary.com/r/blog%3Aelastic-co-security-labs-threat-command-tycoon-2fa-aitm-detection-engineering.md)[E3](https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-inside-knight-office-m365-aitm-attack.md).
- Callback-proxy IPs on the token-callback leg, distinct from the victim IP on the initial request [E3](https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-inside-knight-office-m365-aitm-attack.md).

## How to review
Identify every leg where a code, token, or session crosses a boundary and confirm the invariant: the token is delivered only to a redirect URI and client the app registered, over a channel the user's own browser controls, with no intermediary able to read it. Check that redirect URIs are exact-match allowlisted, that device-code and consent flows cannot be initiated by a third party on the user's behalf, and that token issuance is bound to the originating client and device. Treat any flow where a human copies a code or URL between contexts as suspect by design. On Entra ID, hunt the cross-tier pivot: two distinct ASNs (cloud-VPS then residential-shaped) authenticating the same user within minutes, and treat device registration with non-native UAs (axios) as a red flag [E1](https://bugbountylibrary.com/r/blog%3Aelastic-co-security-labs-threat-command-tycoon-2fa-aitm-detection-engineering.md). Callback-proxy IPs on the token-callback leg (vs. victim IP on initial request) are a reliable AiTM signal [E3](https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-inside-knight-office-m365-aitm-attack.md).

## How finders spotted it
- Decompiled kit JavaScript to map anti-analysis layers and cipher, then correlated sign-in, token, and device telemetry across Entra ID and Google Workspace to fingerprint kit relay (cloud-VPS ASN, Node.js UAs, Auth Broker client) versus operator console (residential ASN, single c_sid, browser UAs) and the ~1s Google four-event sequence [E1](https://bugbountylibrary.com/r/blog%3Aelastic-co-security-labs-threat-command-tycoon-2fa-aitm-detection-engineering.md).
- Investigated anomalous M365 logins, traced the phishing email to an existing legitimate thread, noticed no email instructions for the returned code, and inferred out-of-band WhatsApp communication; a honeypot registration revealed the cookie_reg base64 email and redirect logic [E2](https://bugbountylibrary.com/r/blog%3Avolexity-com-blog-2025-12-04-dangerous-invitations-russian-threat-actor-spoofs-european-security-events-in-targeted-phis.md).
- SOC flagged two post-MFA auth events to Microsoft Authentication Broker from a Comcast IP flagged by Spur as a callback proxy; pivoted on the replay IP in Validin, found the Knight Office operator console, then used VirusTotal and SAT telemetry to map related domains and lures [E3](https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-inside-knight-office-m365-aitm-attack.md).

## Variants seen
- Reverse-proxy AiTM relaying real MFA to steal post-MFA session tokens and mint device-bound PRTs [E1](https://bugbountylibrary.com/r/blog%3Aelastic-co-security-labs-threat-command-tycoon-2fa-aitm-detection-engineering.md).
- Device-code and OAuth authorize abuse via fake event sites redirecting to real Microsoft login [E2](https://bugbountylibrary.com/r/blog%3Avolexity-com-blog-2025-12-04-dangerous-invitations-russian-threat-actor-spoofs-european-security-events-in-targeted-phis.md).
- Device-code relay plus rogue WHfB enrollment for passwordless persistence [E3](https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-inside-knight-office-m365-aitm-attack.md).

## Impact and severity
High: stolen tokens grant M365/Google access [E1](https://bugbountylibrary.com/r/blog%3Aelastic-co-security-labs-threat-command-tycoon-2fa-aitm-detection-engineering.md)[E2](https://bugbountylibrary.com/r/blog%3Avolexity-com-blog-2025-12-04-dangerous-invitations-russian-threat-actor-spoofs-european-security-events-in-targeted-phis.md). Impact rises when token theft is converted to durable persistence — PRTs surviving session revocation [E1](https://bugbountylibrary.com/r/blog%3Aelastic-co-security-labs-threat-command-tycoon-2fa-aitm-detection-engineering.md), rogue device/WHfB keys [E3](https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-inside-knight-office-m365-aitm-attack.md) — and when compromise spreads virally through trusted contacts [E1](https://bugbountylibrary.com/r/blog%3Aelastic-co-security-labs-threat-command-tycoon-2fa-aitm-detection-engineering.md)[E2](https://bugbountylibrary.com/r/blog%3Avolexity-com-blog-2025-12-04-dangerous-invitations-russian-threat-actor-spoofs-european-security-events-in-targeted-phis.md).

## Evidence
- E1: https://bugbountylibrary.com/r/blog%3Aelastic-co-security-labs-threat-command-tycoon-2fa-aitm-detection-engineering.md
- E2: https://bugbountylibrary.com/r/blog%3Avolexity-com-blog-2025-12-04-dangerous-invitations-russian-threat-actor-spoofs-european-security-events-in-targeted-phis.md
- E3: https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-inside-knight-office-m365-aitm-attack.md