Stealing somebody's Microsoft 365 session used to take some skill. Increasingly it takes a browser tab. GraphSpy, an open source tool that puts Entra ID and Microsoft 365 token abuse behind a point and click interface, debuted in a tie for fourth place on Red Canary's list of the ten threats it saw in the most customer environments during July. It is the third tool of that shape to reach the list this year.
GraphRunner arrived in May, Kali365 in June, and now GraphSpy, which despite the similar name is unrelated to GraphRunner. Three separate toolkits in three consecutive months, all after the same prize: the tokens that prove somebody has already signed in, which is what lets an attacker walk past a password and a prompt on somebody's phone.
What a graphical interface buys an attacker
Red Canary describes GraphSpy as running a local web server that presents a browser-based interface, which is precisely what lets less technical adversaries take part. Behind that interface sits device code phishing, where the victim is talked into typing an attacker's one-time code into Microsoft's genuine sign-in page, along with primary refresh token theft and abuse, registering Windows Hello for Business keys, tampering with an account's MFA methods, and pulling data out of SharePoint, OneDrive, Outlook and Teams. IntelFusions covered the device code technique itself in July, when Kaspersky documented a campaign that never sent anyone to a fake website at all.
The top of the list held, the bottom churned
ClearFake took first place for a fourth month running. It injects JavaScript into compromised websites and uses fake CAPTCHA lures to talk people into pasting malicious commands into their own machines. Below it, July was unusually busy. Atomic Stealer fell off the list for the first time since August 2025 and NetSupport Manager for the first time since September 2024, while four threats debuted: GraphSpy, Phexia, CastleRAT and EtherRAT.
Two of the newcomers are after Macs
MacSync Stealer, which goes after credentials, payment card data, keychain contents and cryptocurrency wallets, was joined by Phexia, a modular remote access tool and stealer that Red Canary says is partly modelled on MacSync. It spreads through the same copy and paste lure and persists through a LaunchAgent that runs a Base64 encoded AppleScript at every login. What sets it apart, Red Canary says, is how it finds its command server: it queries Telegram, Steam and public Polygon blockchain smart contracts for the address, which makes conventional domain blocking largely useless because the operators can change the answer at any time. The same Polygon trick showed up in a crypto-stealing botnet that Unit 42 documented this month, so this is now a technique with a following rather than a curiosity.
Switch off the device code flow where nobody needs it
Red Canary's recommendation against the token theft tooling is the unglamorous one: restrict or block the device code authentication flow through Conditional Access policies, for the users and locations that have no need of it. Where an account has already been caught, revoking its refresh tokens and active sessions matters as much as resetting the password, because the token is the thing the attacker is actually holding, and requiring re-authentication is what closes the door. For Phexia, remove whatever the LaunchAgent plist references, unload the plist from launchd, delete it from disk, and consider blocking common blockchain traffic from endpoints with no reason to generate it.
The full top ten, with descriptions of each threat, is in Red Canary's August Intelligence Insights.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.