Threat Overview
ANY.RUN analysis published via The Hacker News on **October 8, 2026** documents Wazza, an evasive phishkit targeting banking, government and manufacturing organizations in the United States, Europe and Australia. An observed chain begins on wildcard `*.boegl-krysl.eu`, checks campaign eligibility at `/api/wazza-config`, receives a client marker from a `beacon-surge-sync…workers.dev` host, obtains a short-lived signed token via `/api/mint-token`, and validates browser telemetry at `check.boegl-krysl.eu` before routing via `/r` and `/meline` to an Adobe-themed device-code phishing page. **Confirmed:** the researchers reproduced the staged delivery and phishing lure in a sandbox. **Not confirmed:** named victim compromises, campaign-wide success rates or a specific identity provider for every lure. Device-code phishing can abuse a legitimate authentication flow to authorize attacker access without requiring a counterfeit password form. The Microsoft Entra hunts below are conditional on Microsoft identity being the target; they do not prove that every Wazza lure uses Microsoft Entra. ATT&CK: T1566.002, T1078 (potential follow-on).
References
ANY.RUN contributed technical investigation via The Hacker News, October 8, 2026
ANY.RUN OAuth device-code phishing background, March 10, 2026
Impacted Systems
**Products/services:** Users of cloud identities supporting OAuth 2.0 device authorization (including Microsoft Entra ID if the lure requests its device-code flow), email/web browsers and endpoint/proxy layers able to access malicious URLs. **Versions:** No software version-specific vulnerability is identified. **Deployment:** Cloud identity; end-user browser-based phishing. **Prerequisites:** User reaches a campaign-qualified phishing page and completes a prompted device-code authentication; no exploit of Adobe software is alleged. **Exposure:** Links delivered by phishing or other channels; observed infrastructure `boegl-krysl.eu` and a `workers.dev` marker host. **Ports:** HTTPS/443 expected; no unique port. **Fixed versions:** Not applicable. **Unaffected:** Organizations blocking device-code grant where unnecessary reduce this specific risk; Adobe-branded lure does not mean Adobe software itself is vulnerable.
Why this matters
Selective anti-bot routing can hide the actual lure from automated URL scanners, while device-code authorization can yield access even if a user never types a password into a phishing page.
Exploitation Status
Confirmed active Wazza phishing kit and sandbox-observed routing. No independently verified victim count, completed token theft count or attribution was published. Successful account compromise remains a potential outcome, not a demonstrated result for every target.
What this hunt looks for
Campaign-domain clicks and egress, selectively routed URL paths, unexpected device-code sign-ins, follow-on identity activity and optional mailbox-rule changes.
Required logs
Use only queries whose listed Sentinel tables are ingested. The hunt set uses: AADNonInteractiveUserSignInLogs, CommonSecurityLog, DeviceNetworkEvents, EmailUrlInfo, OfficeActivity, SigninLogs, UrlClickEvents.
Hunt 1: First pass — Microsoft Entra device-code authentication
Required telemetry: SigninLogs. High signal when unexpected for user/app; only detects Wazza if the lure results in Microsoft Entra device-code authentication.
SigninLogs
| where TimeGenerated >= ago(14d)
| extend Protocol=tostring(column_ifexists("AuthenticationProtocol",""))
| where Protocol has "deviceCode" or Protocol has "device code"
| project TimeGenerated, UserPrincipalName, IPAddress, Location, AppDisplayName, ResourceDisplayName, ResultType, ConditionalAccessStatus, Protocol, CorrelationId
| order by TimeGenerated descHunt 2: Noninteractive device-code sign-in follow-through
Required telemetry: AADNonInteractiveUserSignInLogs. Tenant logging may not populate AuthenticationProtocol for all flows.
AADNonInteractiveUserSignInLogs
| where TimeGenerated >= ago(14d)
| extend Protocol=tostring(column_ifexists("AuthenticationProtocol",""))
| where Protocol has "deviceCode" or Protocol has "device code"
| project TimeGenerated, UserPrincipalName, IPAddress, AppDisplayName, ResourceDisplayName, ResultType, Protocol, CorrelationId
| order by TimeGenerated descHunt 3: Reported Wazza domains in URL clicks
Required telemetry: UrlClickEvents. Requires Defender for Office 365 URL-click ingestion; clicks may be missing for non-email delivery.
UrlClickEvents
| where TimeGenerated >= ago(30d)
| where Url has_any ("boegl-krysl.eu","beacon-surge-sync")
| project TimeGenerated, AccountUpn, Url, ActionType, ThreatTypes, NetworkMessageId
| order by TimeGenerated descHunt 4: Reported Wazza domains in delivered email URL inventory
Required telemetry: EmailUrlInfo. Does not establish that the recipient clicked or authenticated.
EmailUrlInfo
| where TimeGenerated >= ago(30d)
| where Url has_any ("boegl-krysl.eu","beacon-surge-sync")
| project TimeGenerated, NetworkMessageId, Url, UrlDomain
| order by TimeGenerated descHunt 5: Network requests to Wazza infrastructure and redirect paths
Required telemetry: CommonSecurityLog. URL paths are visible only when proxy/firewall records include request URLs; HTTPS without decryption often yields domain only.
CommonSecurityLog
| where TimeGenerated >= ago(30d)
| extend URL=tostring(column_ifexists("RequestURL",""))
| where URL has_any ("boegl-krysl.eu","beacon-surge-sync","/api/wazza-config","/api/mint-token","/meline") or DestinationHostName has "boegl-krysl.eu"
| project TimeGenerated, SourceIP, DestinationIP, DestinationHostName, DestinationPort, URL, DeviceAction, DeviceVendor, DeviceProduct
| order by TimeGenerated descHunt 6: Endpoint network contact with campaign domains
Required telemetry: DeviceNetworkEvents. Exact domains are campaign-specific but may rotate; browser connections do not prove token issuance.
DeviceNetworkEvents
| where TimeGenerated >= ago(30d)
| where RemoteUrl has_any ("boegl-krysl.eu","beacon-surge-sync")
| project TimeGenerated, DeviceName, InitiatingProcessAccountName, InitiatingProcessFileName, RemoteUrl, RemoteIP, RemotePort, ActionType
| order by TimeGenerated descHunt 7: Device-code authentication followed by new IP activity
Required telemetry: SigninLogs. Potential follow-on signal, not proof of token theft; VPNs and legitimate multi-device sessions create noise.
let DeviceCode=SigninLogs
| where TimeGenerated >= ago(14d)
| extend Protocol=tostring(column_ifexists("AuthenticationProtocol",""))
| where Protocol has "deviceCode" and tostring(ResultType)=="0"
| project UserPrincipalName, DeviceCodeTime=TimeGenerated, DeviceCodeIP=IPAddress, DeviceCodeApp=AppDisplayName;
SigninLogs
| where TimeGenerated >= ago(14d) and tostring(ResultType)=="0"
| project UserPrincipalName, TimeGenerated, IPAddress, AppDisplayName, Location
| join kind=inner DeviceCode on UserPrincipalName
| where TimeGenerated between (DeviceCodeTime .. DeviceCodeTime+2h) and IPAddress != DeviceCodeIP
| project UserPrincipalName, DeviceCodeTime, DeviceCodeIP, DeviceCodeApp, TimeGenerated, IPAddress, AppDisplayName, Location
| order by DeviceCodeTime descHunt 8: Suspicious inbox-rule changes after possible account takeover
Required telemetry: OfficeActivity. Generic post-compromise enrichment; Wazza publication did not confirm inbox-rule abuse.
OfficeActivity
| where TimeGenerated >= ago(14d)
| where Operation in~ ("New-InboxRule","Set-InboxRule","UpdateInboxRules","Add-MailboxPermission")
| project TimeGenerated, UserId, Operation, ClientIP, OfficeObjectId, Parameters
| order by TimeGenerated descHunt 9: Entra device-code sign-in burst across users
Required telemetry: SigninLogs. Legitimate shared networks, device provisioning and VPN egress can trigger; validate tenant use of device code.
SigninLogs
| where TimeGenerated >= ago(14d)
| extend Protocol=tostring(column_ifexists("AuthenticationProtocol",""))
| where Protocol has "deviceCode"
| summarize Users=dcount(UserPrincipalName), Attempts=count(), Accounts=make_set(UserPrincipalName,10), Apps=make_set(AppDisplayName,10) by IPAddress, bin(TimeGenerated,1h)
| where Users >= 3 or Attempts >= 10
| order by Attempts descDetection Notes
- Highest signal: unexpected successful device-code authentication for an unusual app/user, particularly when temporally associated with a reported Wazza URL click or network connection.
- The workers.dev marker hostname was partially redacted in the source; only the reported stable substring is used, not an invented full hostname.
- HTTPS proxy logs may expose only a domain, not /api/wazza-config, /api/mint-token, /r or /meline paths.
- Defender for Office 365 EmailUrlInfo and UrlClickEvents cover email-based exposure only; SMS, chat and direct browsing may be invisible.
- Microsoft Entra device-code fields can be absent or have tenant-specific value formatting; legitimate provisioning/devices also use the flow.
- OfficeActivity inbox rules are generic post-compromise checks and were not observed as a Wazza-specific TTP.
All conclusions are limited to data sources and retention actually available in Microsoft Sentinel. Absence of matching activity cannot establish absence of compromise on unmonitored assets or in non-ingested logs. No customer-specific Sentinel workspace was queried and no customer-specific finding is asserted.
