Innovative Attack Method Harvests Microsoft Entra Tokens via Cobalt Strike Beacon, Sidestepping MFA Controls
A recently disclosed tactic leverages Cobalt Strike’s Beacon to harvest Microsoft Entra refresh tokens from compromised systems—even when multi-factor authentication (MFA) is in place. This method grants adversaries prolonged access to cloud assets, especially in environments where traditional Primary Refresh Token (PRT) extraction techniques fall short, such as non-domain-joined or BYOD endpoints.
Unveiled on May 9, the approach introduces a new layer of flexibility for attackers targeting Azure environments where conventional token theft vectors may be unavailable.
Expanding Azure Threat Vectors with Browser-Based Token Capture
At the core of this tactic is “get_azure_token,” a Beacon Object File (BOF) contributed by Christopher Paschen to TrustedSec’s Remote Operations toolkit. Instead of targeting PRTs, this BOF exploits live browser sessions already authenticated with Microsoft Entra. It triggers an OAuth 2.0 authorization code grant flow using predefined client IDs and scopes, intercepting the resulting authorization code and trading it for access and refresh tokens.
Bypassing Redirect Limitations with Native Client URI Exploitation
One challenge with this method lies in the requirement for a client ID that permits http://localhost as a redirect URI—a limitation that confines the attack to specific Microsoft applications, including Azure CLI, Azure PowerShell, and legacy versions of Visual Studio.
To break past this constraint, the researcher engineered a workaround that employs Microsoft’s native client redirect URI (https://login.microsoftonline.com/common/oauth2/nativeclient). By capturing the authorization code directly from the browser window title using the Windows API function GetWindowTextA, the improved version sidesteps localhost limitations and broadens the attack’s applicability across more systems.
“By pulling the code directly from the browser window, we could pivot to using Microsoft’s native client redirect URI. This shift drastically broadens the range of supported Family of Client IDs (FOCIs), lifting the previous constraint of relying solely on apps configured for ‘http://localhost,’” the researcher explained.
Broader App Compatibility Boosts Stealth and Impact
This refinement unlocks access to widely used Microsoft apps such as Teams, Copilot, and Edge—tools that are deeply embedded in daily workflows and typically generate less security scrutiny. By blending into routine traffic, the method offers a considerable operational security (OPSEC) advantage, reducing the likelihood of detection during token harvesting activities.
Demonstration: Deploying the BOF with a Single Command
Execution is straightforward, requiring just one command to activate the technique in a real-world scenario:
Why It Flies Under the Radar
What makes this method especially stealthy is that every authentication and token request appears to come directly from the victim’s own machine. Since all network activity originates from a legitimate, already-trusted IP address, traditional security systems are far less likely to flag it as suspicious.
Extending Cloud Access Beyond Initial Compromise
Paired with tools like GraphSpy, this approach allows adversaries to retain footholds in cloud environments even after their initial access has been disrupted or revoked. It offers a fallback mechanism for maintaining persistence—especially valuable when more common methods, such as Primary Refresh Token (PRT) extraction, aren’t viable.
Although the researcher notes that this method is best suited for niche or edge-case scenarios, it serves as a critical alternative when conventional identity persistence techniques fall short.
To mitigate risk, organizations should adopt rigorous telemetry and behavioral monitoring—especially for irregular usage patterns tied to Microsoft services and anomalous Graph API interactions.
