Azure AD Security Bypass Exploits Phantom Device Registration and PRT Abuse

A recent authorized red team operation by Howler Cell has exposed a critical attack chain that completely bypasses Microsoft Entra ID (Azure AD) Conditional Access without touching a single corporate endpoint or deploying any malware.

Starting with just one set of valid credentials, researchers compromised a production tenant with over 16,000 users and mapped a direct path to Global Administrator privileges.

Azure Conditional Access serves as the primary gatekeeper for cloud identity security, enforcing access rules based on user location, device compliance, and calculated risk scores.

However, this operation revealed that the vulnerability does not lie in any single component but in the misplaced trust chain between device registration and identity services.

Credentials used in the attack are routinely available on cybercriminal markets for a few hundred dollars, making this a realistic and scalable threat.

Phantom Device Registration and PRT Abuse

The attack begins at the Device Registration Service (DRS) endpoint. Researchers from Cyderes discovered that the DRS lacked protection in enforcement mode, allowing authentication through a path that Conditional Access did not intercept.

Critically, the DRS API validates tokens but does not verify that the caller is a real Windows machine.

Using a single command, attackers registered a phantom device, complete with a signed Azure AD certificate and private key, on a simple Linux laptop.

No physical hardware, Trusted Platform Module (TPM), or administrative approval was required.

This technique closely mirrors operations attributed to Storm-2372, a Russian state-aligned threat actor that has been exploiting this gap since August 2024 to target critical infrastructure globally.

Once the phantom device was registered, the attackers generated a Primary Refresh Token (PRT).

Normally secured by hardware, the PRT is one of the most valuable authentication artifacts in a Windows environment, enabling silent access to cloud resources without repeated verification.

In this case, the researchers successfully requested and stored the PRT in a plaintext file.

Because the token carries cryptographic device claims, it convinced the network that the device was legitimately authenticated, successfully bypassing Conditional Access policies requiring a trusted device.

The next hurdle was Intune Mobile Device Management (MDM) compliance. Intune restrictions typically exempt hybrid domain-joined devices from pre-registration checks.

Attackers exploited this by declaring a fake hybrid domain membership during enrollment. When Intune checked the phantom device for security features such as BitLocker and Secure Boot, the fake device returned empty values.

Intune’s default logic interpreted these missing responses as “not applicable” rather than “non-compliant,” officially marking the Linux laptop as a fully compliant corporate device.

With compliance status achieved, the attackers accessed the Intune Management Extension and began downloading enterprise applications.

A single decrypted application package exposed internal server hostnames, administrative share structures, and detailed network architecture intelligence that typically requires weeks of lateral movement inside a compromised network.

The researchers also identified a structural risk in the targeted hybrid environment. Hundreds of on-premises accounts were synced to the cloud with privileged roles, including Global Administrators.

Compromising just one synced on-premises privileged account allowed attackers to reset cloud Global Administrator passwords, granting complete tenant control without requiring any cloud-specific exploits.

The operation’s success was ultimately enabled by what researchers call the “Report-Only” trap.

The targeted environment had multiple Conditional Access policies designed to block device code flows and enforce multi-factor authentication for device registration.

However, these critical policies were left in Report-Only mode, accurately logging every malicious action without blocking any of it.

To defend against this attack path, organizations must immediately audit their Entra ID Conditional Access policies and shift critical rules from report-only to strict enforcement mode, particularly those addressing unauthorized device code flows (MITRE ATT&CK T1556.009) and device registration abuse (T1098.005).

Self-reported device compliance must be replaced with external hardware validation to ensure only genuinely managed endpoints can access corporate environments.

Follow us on Google News , LinkedIn and X to Get More Instant Updates. Set Cyberpress as a Preferred Source in Google