3DCookies phishing kit
3DCookies is a Microsoft 365 phishing kit with proxy and device-code routes behind one CAPTCHA gate. We have matched it on 6 sites since 28 August.
3DCookies in numbers
Since 28 August, the first 3DCookies match in our records, counted on 12 November 2026. How we count.
| Sites with 3DCookies code | 6 |
|---|---|
| Sites with a match in the last 30 days | 2 |
| New sites in October | 1 |
| Last match | 4 November |
A CAPTCHA opens the 3DCookies gateway
A visitor reaches 3DCookies through a phishing link and first sees a CAPTCHA gate. A successful check stores a session ID and token in sessionStorage as __cf_captcha_session and __cf_captcha_token. Gateway requests add __cf_gw=1, while PROXY_EXIT and GATEWAY_FORCE_EXIT messages close the visit.
The gateway can continue along either of two Microsoft sign-in routes. Both keep the phishing site's control logic active while the visitor interacts with Microsoft.
The service worker carries a proxied sign-in
The proxy route registers a service worker with a name beginning gateway-worker- and loads it from /?worker=. It then opens a Microsoft sign-in address inside a sandboxed iframe. The worker handles the frame's requests through the phishing origin.
Behind the page, one action map allocates an ID to each browser tab and reports credentials as pending, valid or invalid. Separate actions accept Microsoft 365 credentials, process submitted cookies, rewrite document scripts and report proxied traffic.
The device-code route uses a genuine Microsoft window
The second route calls /api/graph/device-start and receives a Microsoft verification address, user code and poll ID. The page copies the code and opens the verification address in a window named ms-office-verify. It polls /api/graph/device-poll with the poll ID while the visitor enters the code and signs in. /api/graph/oauth-code handles an authorisation code returned through Microsoft's native-client redirect.
Microsoft handles the sign-in and returns authorisation to the device-code session.
The action map survived changing wrappers
September control-plane pages varied in size and used different randomised route values. Every copy kept the same named actions for credential state, cookie handling, document rewriting, traffic reports and tab allocation. Later pages also replaced more console methods, expanding from the basic log functions to tables, groups, timers and traces.
What we see
| Month | New sites |
|---|---|
| September | 3 |
| October | 1 |
| November so far | 1 |
The latest 3DCookies match was 4 November. 2 sites matched in the last 30 days.
Checking a site for 3DCookies
Inspect the full path, its registered service workers and its same-origin requests. Look for:
- the two
__cf_captcha_storage keys and__cf_gw=1 - a
gateway-worker-service worker loaded from/?worker= - a sandboxed iframe that opens Microsoft sign-in
- named actions for credential state, cookie processing and proxied traffic
/api/graph/device-start,/api/graph/device-polland/api/graph/oauth-code- a verification popup named
ms-office-verify
Remove the gateway, worker and API routes. Review the account that deployed them, revoke affected Microsoft sessions and rotate the site's hosting credentials.