Record · corpus.blog/posts/01a0876d-3f51-734b-b4e4-977e9f4250ed

Phishing for Primary Refresh Tokens and Windows Hello keys

dirkjanm.io · published 10 October 2023

A record is what was published and who pointed at it. The text of the post is not held here: read it at the source, or at its Wayback capture.

Read the post at dirkjanm.io Wayback capture

3blogs citing

First cited: 24 Oct 2023
Most recent: 22 May 2026
Rank this month: not ranked
Links from this post: 13
Words captured: 2,443

Cited by

Blog

In the post

Date

Unit 42

Paved With Intent: ROADtools and Nation-State Tactics in the Cloud Read at the source ↗

22 May 2026

badoption.eu

MobilePhish Read at the source ↗

8 Jan 2024

badoption.eu

MobilePhish Read at the source ↗

8 Jan 2024

Compass Security

Device Code Phishing – Compass Tooling Read at the source ↗

24 Oct 2023

Links from this post

Link

Host

Abusing Azure AD SSO with the Primary Refresh Token Read at the source ↗

dirkjanm.io

Digging further into the Primary Refresh Token Read at the source ↗

dirkjanm.io

Introducing ROADtools Token eXchange (roadtx) - Automating Azure AD authentication, Primary Refresh Token (ab)use and device registration Read at the source ↗

dirkjanm.io

Obtaining Domain Admin from Azure AD by abusing Cloud Kerberos Trust Read at the source ↗

dirkjanm.io

Presentations and external blogs Read at the source ↗

dirkjanm.io

https://github.com/kiwids0220/deviceCode2WinHello

github.com

https://twitter.com/mhskai2017

twitter.com

https://github.com/BakkerJan/evilginx3/blob/main/microsoft365.yaml

github.com

https://github.com/dirkjanm/ROADtools

github.com

Introducing a new phishing technique for compromising Office 365 accounts Read at the source ↗

aadinternals.com

https://0xboku.com/2021/07/12/ArtOfDeviceCodePhish.html

0xboku.com

https://github.com/secureworks/squarephish

github.com

https://www.blackhillsinfosec.com/dynamic-device-code-phishing/

blackhillsinfosec.com