GitHub RadarRed team tool
Dynamic Device Phishing tool that creates a new code only when user clicks on link or email is sent. Primary language: Python. 12 stars.
Project links:Open GitHub projectBack to radar
<p align="center"> <!-- <img width="1024" height="1024" alt="image" src="https://github.com/user-attachments/assets/3deb2d0c-4b45-4b48-a330-5ddd537e77fc" /> --> <img width="400" height="400" src="https://github.com/user-attachments/assets/bc360cc6-f6bc-4074-bab3-fcb35b25a660" />
</p>
MSCodePhish is a red‑team toolkit that turns Microsoft’s Device Code OAuth flow into an embeddable phishing primitive that works inside any lure (e.g., “grab your coupon,” “unlock access,” etc.). Instead of pre‑generating device codes and racing against the usual 15‑minute timeout, MSCodePhish exposes a simple API endpoint that phishing pages can call via JavaScript (XHR/fetch) at the exact moment a victim opens the page. The tool then generates a fresh device code on demand, returns it to the phishing page (e.g., rendered as a “coupon code”), and instructs the user to complete the login on the legitimate Microsoft device login portal using that code.
Behind the scenes, MSCodePhish continuously polls Microsoft’s token endpoint for that device code and, once the victim finishes authentication, captures the resulting refresh token and related claims (tenant, user, etc.). From its web UI, operators can track active campaigns, monitor which lures are converting, and use captured refresh tokens to request new access tokens for different resources (ARM, Key Vault, Graph, Storage, or custom scopes) in real time. Because the code is generated only when the phishing HTML is actually loaded, MSCodePhish effectively sidesteps device‑code expiration issues and enables more realistic, flexible phishing flows that closely mimic benign “promo code” or “access code” UX patterns.
The framework is aimed at offensive security teams and researchers who want to test how easily users can be manipulated into completing the device code flow on a legitimate Microsoft page, and to demonstrate the downstream impact of a single successful device‑code phish in modern Azure/M365 environments.
---
https://github.com/user-attachments/assets/0b077191-57d2-4a32-affb-a690829e182b
https://github.com/user-attachments/assets/998d1c69-0fc9-4c05-b25c-48d2b50a818e
mscodephish is auto‑seeded on first run, password mscodephish).Mail.Send.{{user_code}} and {{verification_uri}}.az login --use-device-code.client_id and scope; no client secret.---
pip install -r requirements.txt.env file in the project root (same folder as run.py).Common settings:
SECRET_KEY – Flask secret key for sessions/CSRF.DATABASE_URL – SQLAlchemy connection string. Examples:sqlite:///devicecode.db (default; file in instance/)sqlite:///C:/path/to/devicecode.dbThe app automatically loads .env on startup; you don’t need to export variables manually.
python run.pyThen open http://127.0.0.1:5000/mscodephish/login in your browser.
---
On first startup, a default admin user is created:
mscodephishmscodephishFlow:
/mscodephish/login.mscodephish / mscodephish.You can later rename this account and change its password from the Profile page.
---
When creating a phishing campaign in the UI:
az login --use-device-code and the Microsoft device code API:organizations tenant.client_id and scope; no client secret.https://login.microsoft.com/device (or https://microsoft.com/devicelogin) and the user code.Configure how emails are sent:
Mail.Send permission.{{user_code}} - the device user code.{{verification_uri}} - the device login URL (e.g. https://login.microsoft.com/device).---
This toolkit is intended only for:
Using it against accounts, tenants, or systems without explicit written permission may be illegal and unethical. You are responsible for complying with all applicable laws, contracts, and organizational policies.
Use only where you have explicit authorization to conduct phishing and token capture (e.g. internal red team, authorized pentest). Unauthorized use may be illegal.