3DCookies phishing kit

A CAPTCHA opens the 3DCookies gateway

A visitor reaches 3DCookies through a phishing link and first sees a CAPTCHA gate. A successful check stores a session ID and token in sessionStorage as __cf_captcha_session and __cf_captcha_token. Gateway requests add __cf_gw=1, while PROXY_EXIT and GATEWAY_FORCE_EXIT messages close the visit.

The gateway can continue along either of two Microsoft sign-in routes. Both keep the phishing site's control logic active while the visitor interacts with Microsoft.

The service worker carries a proxied sign-in

The proxy route registers a service worker with a name beginning gateway-worker- and loads it from /?worker=. It then opens a Microsoft sign-in address inside a sandboxed iframe. The worker handles the frame's requests through the phishing origin.

Behind the page, one action map allocates an ID to each browser tab and reports credentials as pending, valid or invalid. Separate actions accept Microsoft 365 credentials, process submitted cookies, rewrite document scripts and report proxied traffic. The browser view and operator control plane are therefore parts of the same page package.

The device-code route uses a genuine Microsoft window

The second route calls /api/graph/device-start and receives a Microsoft verification address, user code and poll ID. The page copies the code and opens the verification address in a window named ms-office-verify. It polls /api/graph/device-poll with the poll ID while the visitor enters the code and signs in. /api/graph/oauth-code handles an authorisation code returned through Microsoft's native-client redirect.

This route collects authorisation through the genuine Microsoft window, so the 3DCookies landing page can complete its job without displaying its own password field.

The action map survived changing wrappers

Retained September control-plane pages varied from about 149 KB to 167 KB and used different randomized route values. Every copy kept the same named actions for credential state, cookie handling, document rewriting, traffic reports and tab allocation. Later pages also replaced more console methods, expanding from the basic log functions to tables, groups, timers and traces.

What we see

Month	New sites
September	3
October so far	0

The latest 3DCookies match in this snapshot was 22 September. 1 site matched in the last 30 days.

Checking a site for 3DCookies

Inspect the full path, its registered service workers and its same-origin requests. Look for:

• the two __cf_captcha_ storage keys and __cf_gw=1
• a gateway-worker- service worker loaded from /?worker=
• a sandboxed iframe that opens Microsoft sign-in
• named actions for credential state, cookie processing and proxied traffic
• /api/graph/device-start, /api/graph/device-poll and /api/graph/oauth-code
• a verification popup named ms-office-verify

Remove the gateway, worker and API routes. Review the account that deployed them, revoke affected Microsoft sessions and rotate the site's hosting credentials.