A new technique that enables attackers to obtain Microsoft Entra refresh tokens from compromised endpoints using Cobalt Strike Beacon, potentially bypassing multi-factor authentication (MFA) protections and maintaining persistent access to cloud resources. A significant limitation of the original approach is that it requires the specified client ID to allow “ ; as the redirect_uri parameter, which restricts attackers to using only a handful of Microsoft applications that support this configuration. Infosecnoodle reports that this BOF leverages the user’s existing browser authentication to Entra by initiating an authorization code flow for a specified client ID and scope, then capturing the authorization code to request access and refresh tokens. To overcome this limitation, the researcher devised an improved technique utilizing Microsoft’s native client redirect URI ( ) and extracting the authorization code from the browser window title using the GetWindowTextA API. This enhancement significantly expands the attack surface by enabling the technique to work with popular Microsoft applications including Teams, Copilot, and Edge, which can make a massive difference in terms of OPSEC as these applications are less likely to trigger security alerts. “If we extracted it from there, it could allow us to use the native client redirect URI instead, giving us access to a much larger range of FOCIs and removing the restriction of only being able to use FOCIs that allow ‘ ; as the redirect URI,” the researcher wrote. The researcher identified only three Microsoft applications with the necessary Family of Client IDs (FOCI) capabilities that also support the localhost redirect: Microsoft Azure CLI, Microsoft Azure PowerShell, and Visual Studio – Legacy. While the researcher acknowledges this is primarily for “edge-case scenarios” and that PRT extraction remains a more reliable method for identity persistence when possible, the technique provides attackers with an additional option when traditional methods fail. Organizations are advised to implement comprehensive monitoring for suspicious authentication activities, particularly those involving sensitive Microsoft applications and Graph API access.
This Cyber News was published on cybersecuritynews.com. Publication date: Mon, 12 May 2025 09:10:21 +0000