New Technique that Let Attackers Obtain Microsoft Entra Refresh Tokens via Beacon

A new technique that enables attackers to obtain Microsoft Entra refresh tokens from compromised endpoints using Cobalt Strike Beacon, potentially bypassing multi-factor authentication (MFA) protections and maintaining persistent access to cloud resources. The technique, published on May 9, addresses scenarios where traditional Primary Refresh Token (PRT) extraction isn’t possible, particularly on non-domain-joined or BYOD devices. […] The post New Technique that Let Attackers Obtain Microsoft Entra Refresh Tokens via Beacon appeared first on Cyber Security News.

May 12, 2025 - 10:21

New Technique that Let Attackers Obtain Microsoft Entra Refresh Tokens via Beacon

A new technique that enables attackers to obtain Microsoft Entra refresh tokens from compromised endpoints using Cobalt Strike Beacon, potentially bypassing multi-factor authentication (MFA) protections and maintaining persistent access to cloud resources.

The technique, published on May 9, addresses scenarios where traditional Primary Refresh Token (PRT) extraction isn’t possible, particularly on non-domain-joined or BYOD devices.

Novel Technique Expands Attack Surface for Azure Token Theft

The technique utilizes a recently added Beacon Object File (BOF) to TrustedSec’s Remote Operations repository called “get_azure_token,” developed by Christopher Paschen.

Infosecnoodle reports that this BOF leverages the user’s existing browser authentication to Entra by initiating an authorization code flow for a specified client ID and scope, then capturing the authorization code to request access and refresh tokens.

A significant limitation of the original approach is that it requires the specified client ID to allow “http://localhost” as the redirect_uri parameter, which restricts attackers to using only a handful of Microsoft applications that support this configuration.

The researcher identified only three Microsoft applications with the necessary Family of Client IDs (FOCI) capabilities that also support the localhost redirect: Microsoft Azure CLI, Microsoft Azure PowerShell, and Visual Studio – Legacy.

To overcome this limitation, the researcher devised an improved technique utilizing Microsoft’s native client redirect URI (https://login.microsoftonline.com/common/oauth2/nativeclient) and extracting the authorization code from the browser window title using the GetWindowTextA API.

“If we extracted it from there, it could allow us to use the native client redirect URI instead, giving us access to a much larger range of FOCIs and removing the restriction of only being able to use FOCIs that allow ‘http://localhost’ as the redirect URI,” the researcher wrote.

This enhancement significantly expands the attack surface by enabling the technique to work with popular Microsoft applications including Teams, Copilot, and Edge, which can make a massive difference in terms of OPSEC as these applications are less likely to trigger security alerts.

Proof of Concept: The BOF in Action

The technique can be implemented using a simple command:

This technique is particularly concerning because all authentication requests and token requests originate from the compromised endpoint’s IP address, making them difficult to detect as malicious.

When combined with post-exploitation tools like GraphSpy, attackers can maintain persistent access to cloud resources even after initial access is lost.

While the researcher acknowledges this is primarily for “edge-case scenarios” and that PRT extraction remains a more reliable method for identity persistence when possible, the technique provides attackers with an additional option when traditional methods fail.

Organizations are advised to implement comprehensive monitoring for suspicious authentication activities, particularly those involving sensitive Microsoft applications and Graph API access.

Vulnerability Attack Simulation on How Hackers Rapidly Probe Websites for Entry Points – Free Webinar

The post New Technique that Let Attackers Obtain Microsoft Entra Refresh Tokens via Beacon appeared first on Cyber Security News.