Windows Analysis Report
https://1drv.ms/w/c/21d4211537246b47/IQBQa7A4FXXcTp9l5gtSRmCdAXYW_UM-eIL0SWZE4oiJDkc?e=zUSnp2

# Phishing Analysis Report

## Threat Overview

This attack targets users through a coordinated device code phishing scheme designed to steal Microsoft Office 365 credentials. The attacker uses a fake document lure to redirect users to a malicious landing page, then instructs them to complete account verification on the legitimate Microsoft login portal using a provided device code, enabling unauthorized account access.

## Key Findings

### Initial Lure & Misdirection
- The attack begins with a fake Excel document ("Document 5.docx") presented to the user
- The malicious landing page is hosted on **docu.setup-projekts.sbs**, an unrelated third-party domain that impersonates Microsoft and Excel branding
- This domain registration creates false legitimacy and masks the attacker's infrastructure

### Device Code Phishing Flow
- A modal dialog appears with the header "Datei: PROJEKT" (File: PROJECT) and demands urgent verification
- A verification code **"GDMWQGNV4"** is displayed with a countdown timer showing **"Expires in 14m 33s"**
- The time pressure is a social engineering tactic designed to rush the user into action without careful inspection
- Instructions prompt the user to:
  1. Copy the verification code
  2. Click on "Besttigen" (Confirm)
  3. Enter the code at login.microsoftonline.com

### Credential Harvesting Infrastructure
- The browser shows a simultaneous redirect to **login.microsoftonline.com/common/oauth2/deviceauth** in the address bar
- While this appears to be the legitimate Microsoft login endpoint, it is being invoked within the attacker's malicious flow
- The legitimate Microsoft login page (visible on the right side of the screenshot) is overlaid with the fake verification dialog
- This technique exploits user confusion about which interface is authentic

### Technical Obfuscation
- Cloudflare verification and repeated redirects are employed to evade detection and analysis
- The malicious domain uses multiple URL parameters designed to obfuscate the true source and intent of the page

## Conclusion

This is a sophisticated **device code phishing attack** that combines multiple deception techniques: fake document branding, domain impersonation, artificial urgency through countdown timers, and a seemingly legitimate Microsoft login flow. The attacker's objective is to trick users into completing device code verification, granting the attacker legitimate access to the victim's Microsoft Office 365 account. The attack relies on the user's trust in familiar branding and the pressure created by the expiring verification code to bypass security awareness.