Device-Code Phishing Attack Simulation
Lets an agent run authorized red-team device-code and consent phishing tests against Microsoft Entra ID.
- Repository
- mukul975/Anthropic-Cybersecurity-Skills
- Stars
- 35,430
- Licence
- Apache-2.0
- Files
- 4 files
What it does
This skill gives an AI agent a detailed playbook for simulating a real attack on Microsoft 365 accounts: tricking a user into entering an attacker-generated code on Microsoft's genuine login page so the attacker receives OAuth tokens, bypassing MFA. It also covers illicit consent grants, where a malicious app is approved by a victim. A bundled Python script implements the device-code flow so the agent can request codes, poll for tokens and optionally reuse a refresh token. It is intended for security professionals testing their own or explicitly authorized tenants.
Great for
- Authorized red teams testing Microsoft 365 and Entra ID defenses under written rules of engagement
- Security engineers validating Conditional Access, token protection and phishing-resistant MFA
- Blue teams who need realistic device-code attack telemetry to build detections
Skip it if
- Anyone without written authorization for the target tenant, since the skill is built to steal real users' tokens and using it against others is illegal (CFAA and equivalents)
- General users looking for account security help, because the content is offensive tradecraft rather than defensive guidance
- Non-security tasks, as the skill has no value outside red-team or detection work
Try asking
- “Simulate a device-code phishing pretext against our test tenant under the signed rules of engagement and report MFA bypass risk”
- “Walk through requesting a device code with the Microsoft Office client ID and explain each token field”
- “Test whether our tenant blocks the OAuth device-code flow and recommend Conditional Access policies”
- “Build Splunk or Sentinel detections for device-code token issuance using realistic attack patterns”
Install in 3 steps
- 1
Download the skill
The ZIP contains the 4 original files, the Apache-2.0 licence and an attribution note.
attacking-oauth-with-device-code-phishing.zip - 2
Add it to your agent
Claude Code (all projects)
mkdir -p ~/.claude/skills && unzip attacking-oauth-with-device-code-phishing.zip -d ~/.claude/skills/Claude Code / Agent SDK (this project only)
mkdir -p .claude/skills && unzip attacking-oauth-with-device-code-phishing.zip -d .claude/skills/Claude apps (web/desktop): Settings → Capabilities → Skills → Upload skill, and choose the ZIP.
- 3
Ask for the task
No special command needed — the agent reads the skill's description and loads it when your request matches. Try one of the prompts above.
Get better results
- Scope the engagement explicitly in the prompt, naming the tenant and the permitted techniques, so the agent stays inside the rules of engagement
- Review agent.py before running it, since it makes live token requests against Microsoft endpoints
- Ask for the defensive output too (detections and Conditional Access recommendations) to get the most value for a blue-team report
What's inside
- references/api-reference.md
- references/standards.md
- scripts/agent.py
- SKILL.md
Redistributed unmodified from mukul975/Anthropic-Cybersecurity-Skills under the Apache-2.0 licence. The assessment was drafted with AI from the skill's files on 2026-10-29. Skills can instruct your agent to run code — read SKILL.md and any scripts before installing.