InfoSec Briefing - July 08, 2026

🎧 Audio Briefing

Playback Speed:

Cyber security developments for Wednesday the 8th of July 2026 covering articles added to the BlueTeamSec community on infosec.pub. Today we have 2 articles to cover. All attribution is by the article authors. All article analysis is automated.

Rasta Mouse has written up a modular API hooking technique called hook chains that lets you register multiple hook functions in sequence for a single API call. The approach splits complex tradecraft operations like stack spoofing and payload masking into discrete functions rather than one monolithic hook, which is particularly useful if you're building frameworks that need to compose evasion techniques cleanly.

Casey Smith has released EasyTokens, an adversary emulation tool that replicates the device-code phishing technique we've seen in campaigns like the ARToken operation covered earlier this week. It targets Microsoft 365 by exploiting the OAuth device authorisation flow to capture access and refresh tokens when victims authenticate at the legitimate Microsoft device login portal. One for red teams or anyone testing defences against OAuth-based phishing.

That concludes today's briefing.

📰 Articles Covered

Hook Chains (how I built Crystal Kit incorrectly*) - Rasta Mouse

This precis outlines the technical functionality of "CPL Hook Chains" as described by RastaMouse. The technique concerns the modular management of API hooking, a practice often used in red teaming and malware development for evasion and instrumenting processes.

### What Happened & Technical Details
The article introduces a feature within the CPL (likely an internal or specialized framework) that enables "hook chains." Rather than hardcoding multiple operations (such as masking and spoofing) into a single hook function, this design allows developers to register multiple hooks for a single API in a specific sequence 【1】.

* **Workflow:**
* **Registration:** The user initializes a hook chain for a target API (e.g., `KERNEL32$Sleep`) without specifying a hook function using the `addhook` command 【1】.
* **Attachment:** Multiple discrete hook functions are then attached in the desired order using the `attach` command 【1】.
* **Mechanism:** When an API call is made, the execution flows through the chain. For example, a sleep request might flow through a "Masking" function, then to a "Spoofing" function, effectively daisy-chaining the modifications before reaching the original API 【1】.

### Who is Affected
This information primarily impacts security professionals involved in **offensive security engineering** (who gain a more modular way to manage their tools) and **defenders/EDR vendors** (who must detect the resulting API hooking behavior). It is not a vulnerability in a specific product, but rather a modular design pattern for intercepting system calls.

### Security Implications
* **Modularity & Maintainability:** The architecture allows developers to separate complex tradecraft (e.g., separating stack spoofing from payload masking). Components can be developed in isolation without needing to be aware of one another 【1】.
* **Agility:** Modifying offensive capabilities—such as adding, removing, or swapping techniques—can be achieved via simple changes in a specification file rather than requiring extensive re-coding or re-compilation 【1】.
* **Evasion:** By cleanly chaining multiple evasion techniques, developers can more effectively hide malicious activity from monitoring tools that look for specific API patterns.

### What Defenders Should Know
* **API Hooking Persistence:** Defenders should remain aware that techniques allowing for modular, chained hooking facilitate more robust and easier-to-maintain malicious instrumentation.
* **Detection Strategy:** Because these hooks often manipulate the Import Address Table (IAT) or use inline hooking to point to custom functions, defenders should prioritize monitoring for:
* Unexpected redirections in the IAT of running processes.
* Inline patches or "detours" at the start of commonly hooked functions (like `Sleep`, `VirtualAlloc`, etc.).
* Unsigned or suspicious memory regions that function as the destination for these redirected API calls.
* **Dynamic Analysis:** Understanding that attackers can now swap these modular components easily suggests that static signatures for a specific "payload" may be less reliable, as the underlying chain of hooks can be reconfigured rapidly.
EasyTokens: Kali365 - EvilTokens Replica - Casey Smith

EasyTokens is an adversary emulation tool designed to conduct device-code phishing attacks, allowing operators to capture and utilize Microsoft 365 OAuth tokens 【1】.

### What Happened
The tool facilitates a phishing campaign that exploits the Microsoft OAuth 2.0 Device Authorization Grant flow. An operator initiates a campaign, which provides a user code to the victim and directs them to authenticate at the legitimate Microsoft device login portal. Once the victim completes the authentication process, the EasyTokens server detects the authorization, captures the resulting OAuth tokens (access and refresh), and grants the operator unauthorized access to the victim's Microsoft 365 resources 【1】.

### Who Is Affected
The primary targets are users of Microsoft 365 environments. Because the attack leverages a legitimate Microsoft authentication flow, it can bypass traditional credential-harvesting defenses that rely on detecting fake login pages, as the victim performs the actual authentication at an official Microsoft URL.

### Security Implications
* **Unauthorized Access:** Operators can search and access a victim's OneDrive files and emails via the Microsoft Graph API 【1】.
* **Persistence:** The capture of `offline_access` (refresh) tokens allows operators to maintain access to a victim’s account even after the initial phishing session has concluded.
* **Trust Exploitation:** By utilizing the official `microsoft.com/devicelogin` portal, the attack successfully subverts user intuition about verifying login URLs.

### Technical Details
* **Mechanism:** The tool uses a background poller to monitor the device code flow and automatically capture tokens upon successful user completion. It stores these credentials in a local SQLite database 【1】.
* **Infrastructure:** EasyTokens features an operator UI for campaign management and supports a distributed architecture using a PHP-based relay node that forwards captured tokens to a central command panel via webhooks 【1】.
* **OAuth Configuration:** The tool is configured with specific scopes (e.g., `Mail.Read`, `Files.Read`, `offline_access`) and utilizes a client ID associated with Microsoft Office to perform these requests 【1】.

### What Defenders Should Know
Defenders should be aware of the following mitigation and detection strategies:
* **User Awareness:** Educate users on the risks of entering device codes from untrusted sources, particularly those that do not originate from a known, legitimate workflow.
* **Monitor Device Code Usage:** Audit logs for suspicious or high-frequency usage of the device code flow.
* **Conditional Access Policies:** Implement Conditional Access policies that restrict the ability of users to utilize the Device Code flow or enforce stricter requirements for authentication.
* **Endpoint Detection:** Monitor for unexpected traffic patterns involving `graph.microsoft.com` or unauthorized applications attempting to use tokens associated with standard Office client IDs.