FlowerStorm phishing kit

The flower names came from the page titles

Sophos documented FlowerStorm as an adversary-in-the-middle Microsoft phishing kit. Researchers chose the name after finding botanical words such as OreganoLeaf and Elderberry in page titles.

The phishing server sits inside the sign-in

A Cloudflare Turnstile check stands in front of the sign-in page. Behind it, the page sends each step to next.php as JSON, with operations such as do:"check" and do:"login", a Base64-encoded password in a pass field and a token carried between requests. The phishing server relays those steps to Microsoft, so it holds the credentials, the MFA response and the authenticated session that comes back.

Device codes came from Kali365

Proofpoint reported that the operators it tracks as FlowerStorm added device-code phishing by using Kali365. Those pages run Kali365 code: a scoring gate, a copied device code and Microsoft's own sign-in window.

Finding FlowerStorm code

Record the exact path, redirects and Turnstile request with test values. Search the response and later requests for:

• a botanical word in the page title
• JSON requests to next.php with do:"check" or do:"login"
• a Base64-encoded password in pass and a token carried between requests

Remove the phishing page and its relay routes. Review hosting, DNS and deployment access and rotate their credentials.