script.google.com

Entering this trap's code at the real Microsoft device-login screen authorizes an attacker's session — MFA included. Sign-in tokens are stolen, not passwords, so no credential form ever has to appear — which is why this slips normal phishing checks.

This page carries no branding itself, which is expected — it hands the visitor on to ibtuxr641i.c4-explosive-workshops.de, which wears the Microsoft costume, where the code is shown.

G2ALFYLTK

This page hands its visitor on to https://ibtuxr641i.c4-explosive-workshops.de/l/dN8uUIAgPm0?key=b356b170f21238f76443ae18 (reached via mmasunandrajat.com), which we opened and analysed: it runs a Microsoft device-code sign-in flow. In that flow the victim authenticates on the REAL provider — password, MFA and all — and the session they approve belongs to whoever started the flow. The code above is the one WE were shown: this kit mints a new one per visit, so the victim's own code will differ. That page is dressed as Microsoft, which this one is not — the carrier hands the visitor on without a costume of its own, so the impersonation only becomes visible one document further on. Evidence: Microsoft device-login ref: login.microsoftonline.com/common/oauth2/deviceauth (via frame-inline-script-sink); on non-legit host ibtuxr641i.c4-explosive-workshops.de; code "G2ALFYLTK"; device-code instructions present.