Advanced Wazza Phishing Kit Leverages Multi-Stage Routing and Device Code Tactics to Target Critical Global Sectors

Device Code authentication is a legitimate OAuth 2.0 flow designed for devices that have limited input capabilities, such as smart TVs or IoT devices. In a malicious context, the attacker initiates a login request and presents the victim with a code, instructing them to enter it into a legitimate service’s authorization page. If the victim follows these instructions and authorizes the request, the attacker gains an access token for the victim’s account.

This method is significantly more dangerous than traditional credential harvesting. It allows attackers to target the authentication session itself rather than just the password. Because the victim is often performing the authorization on a legitimate domain, it can bypass certain types of Multi-Factor Authentication (MFA) and conditional access policies. The use of a recognizable brand like Adobe makes the request appear routine to an office worker, who may be accustomed to frequent software updates and re-authentication prompts.

Geographic Reach and Sector-Specific Targeting

The Wazza campaign is not a broad, "spray-and-pray" operation. Analysis of the infrastructure and deployment patterns indicates a calculated focus on specific regions and industries. ANY.RUN has identified active Wazza nodes targeting organizations in the United States, Europe, and Australia.

The choice of sectors—banking, manufacturing, and government—is particularly telling. These industries manage high-value assets and sensitive information that are highly prized by both financially motivated cybercriminals and state-sponsored actors. Financial institutions are perennial targets due to the potential for direct monetary theft and account takeovers. Manufacturing organizations are often targeted for intellectual property theft or to gain a foothold in interconnected supply chains. Government agencies, meanwhile, manage critical infrastructure and sensitive citizen data, making them prime targets for espionage or disruptive operations.

The underlying delivery technique used by Wazza is highly adaptable. While the current campaign utilizes an Adobe theme, the modular nature of the phishkit allows attackers to swap lures easily. The core infrastructure—the filtering, tokenization, and multi-stage routing—remains the same regardless of whether the final lure mimics Microsoft 365, a banking portal, or a government service.

The Operational Burden on MSSPs and Security Operations Centers

For Managed Security Service Providers (MSSPs), evasive kits like Wazza introduce significant operational friction. MSSP analysts are often tasked with investigating hundreds of alerts daily across multiple client environments. When a URL appears benign because it is protected by Wazza’s filtering logic, it creates a high degree of uncertainty.

Automated security systems may flag a URL as suspicious, but when an analyst attempts to verify it, they may be blocked by the anti-bot gates. If the analyst cannot reproduce the full attack chain, they may incorrectly classify the alert as a false positive. Alternatively, the uncertainty may force a Tier 1 analyst to escalate the case to a more senior Tier 2 or Tier 3 analyst, simply to determine if the link is actually malicious.

This leads to a cascade of efficiency issues: increased Mean Time to Respond (MTTR), higher escalation rates, and a reduction in the SOC’s capacity to handle genuinely complex incidents. The "hidden" nature of the payload means that traditional reputation-based blocking is often one step behind the attackers, as the final phishing page is never exposed to the public internet or automated scanners.