OnyxC2 phishing artifact mimicking Microsoft device-code credential add flow

Duo Tech@duotech

•updated Aug 14, 2026•2•0•8

Detects a credential-phishing email linking to a spoofed Microsoft device-code login flow (deviceaddcredential.srf) from a sender/recipient domain mismatch, or delivery of the associated known malicious attachment hash.