OPTA / Nova Panel: device-code phishing pages that hand a Microsoft sign-in code to an operator panel

Phishing pages exported by OPTA, a phishing panel that is also deployed under the name "Nova Panel". The page imitates a Microsoft, DocuSign, Adobe Sign or OneDrive "verify your identity" step and shows a short code with a link to Microsoft's real device sign-in page. Behind it, the operator's panel has started a Microsoft device-code sign-in, so a victim who types the code signs the operator in: the panel receives the account's tokens, in some modes a Primary Refresh Token, without ever seeing the password. The pages are hosted on cloud object storage, on Cloudflare Workers or on hacked websites, and some are wrapped in a simple encoding that unpacks when the page loads. The panel also offers mailbox access, contact extraction, MFA and Windows Hello enrolment on captured accounts, a tracked link per campaign, and referrer and visitor filters that hide the pages from scanners. A match means a scan reached such a page or one of the operator's panels.