CodeStorm Phishing Campaign Targets M365 Tenants With Token Reuse and Replay Attacks

A multi-organization phishing campaign attributed to the CodeStorm family is actively targeting Microsoft 365 tenants with a tenant-aware AiTM (adversary-in-the-middle) phishing kit that combines rotating frontends and backend replay behavior under a stable controller path, /google.php.

The human recipient rarely scrolls to that dummy conversation, but automated secure email gateways frequently do; the added “conversation stuffing” causes many scanners to misclassify the message as a low-risk thread hijack rather than an outright lure, lowering phishing detection scores.

Technically, the kit separates scale from protocol. Frontend domains rotate across multiple TLDs and randomized hosts, carrying the victim identity in query parameters or URL fragments (plain e=, fragment tokens, or base64-encoded fragments).

Frontends lead to an obfuscated first-stage HTML that enforces a Cloudflare Turnstile challenge, actively blocks analysis (navigator.webdriver, Burp, Phantom probes), disables common DevTools shortcuts, and implements a debugger timing trap that redirects analysts to a legitimate-looking Microsoft encryption URL when the page appears under inspection.

Fragments avoid server-side logs and many telemetry pipelines, hindering detection if defenders overfit to a single parameter pattern.

Analysts at ZeroBEC observed the campaign using a voicemail-themed email lure that deliberately appends a large, unrelated historical thread below a block of whitespace.

Passing the gate loads a second-stage bootstrapper observed as bootstrappp.min.js hosted on third-party object storage in one cluster which points consistently to a backend controller under /google.php.

CodeStorm Phishing Campaign Targets M365

Static and runtime analysis reveals a compact action contract: do=check for identity discovery, do=login to submit credentials, do=verify to initiate MFA workflows, and checkVerify to relay MFA codes.

The package contains handlers for a full MFA bypass arsenal: Authenticator push and OTP, SMS, voice call, and Hotmail recovery flows.

Importantly, do=check performs Microsoft-style home-realm discovery and returns provider-aware routing (managed M365, federated tenants, or GoDaddy-managed Microsoft 365) plus an opaque canary value.

That tenant-aware branching means the phishing UI adapts to the victim’s real identity configuration rather than serving a one-size-fits-all fake login page.

In one cluster the payload is bootstrappp.min.js hosted on Tencent Cloud Object Storage (cos.na-ashburn.myqcloud[.]com).

Controlled telemetry confirms the backend actively replays credentials against Microsoft, not only harvesting them. In a ZeroBEC-managed test, credentials submitted to do=login produced Microsoft-style error responses and corresponding OfficeHome sign-in failures (ErrorCode 50126) in the victim tenant’s Entra logs within seconds.

Replay attempts originate from the kit’s outbound IPs and present a normalized browser user-agent fingerprint, providing direct evidence of live validation rather than deferred exfiltration.

For defenders, the detection surface sits less on static domains and more on protocol-level indicators: cross-site POSTs to /google.php with form bodies containing do=check/do=login, presence of cf-turnstile on landing pages, analysis-evasion JavaScript patterns (debugger timing traps, navigator/webdriver probes), and appended dummy conversation stuffing in email bodies.

Hunting should correlate phishing-click events with anomalous OfficeHome sign-in failures (50126), unusual geographic MFA prompts, or subsequent mailbox reads and OAuth grants.

Key public analysis for context and mapping includes Hexastrike on CodeStorm, Microsoft’s Tycoon2FA research, Sekoia and Darktrace analyses, and Huntress on related device-code phishing families; this protocol-level view augments those reports by exposing the /google.php contract and tenant-aware do=check behavior.

Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.