Inside Wazza: A Newly Observed Device Code Phishing Kit Targeting Microsoft 365 Accounts

The report

LevelBlue SpiderLabs has been tracking multiple waves of Wazza, a newly observed multi-stage phishing kit that deploys device code phishing targeting Microsoft 365 accounts.

Read the full analysis: Inside Wazza: A Newly Observed Device Code Phishing Kit Targeting Microsoft 365 Accounts (levelblue.com).

Indicators

Phishing

• hutspotmaken[.]eu

Defanged so they cannot be clicked by mistake: replace [.] with a dot. Shared hosting and CDN addresses named in the report are left out on purpose, so blocking these does not break legitimate sites.

How this is tracked

EncryptLayer intelligence, A.R.P. Syndicate’s open threat feed, reviews each indicator against the published report before adding it (#24). This page is generated from that record and the report’s own title and summary; nothing is rewritten.