FlowerStorm phishing kit
FlowerStorm is a group of Microsoft phishing pages with verification gates, adversary-in-the-middle sign-ins and device-code branches. We have matched it on 146 sites since 2 August.
FlowerStorm in numbers
Since 2 August, the first FlowerStorm match in our records, counted on 12 October 2026. How we count.
| Sites with FlowerStorm code | 146 |
|---|---|
| Sites with a match in the last 30 days | 25 |
| New sites in September | 35 |
| Sites captured since 25 September | 18 |
The flower names came from the page titles
Sophos documented FlowerStorm as an adversary-in-the-middle Microsoft 365 kit active from June 2024. Researchers chose the name after finding botanical words in page titles. In that branch, a reverse proxy carries the visitor through the real sign-in, MFA challenge and authenticated session while the phishing server stays between the browser and Microsoft.
Infoblox later traced a FlowerStorm campaign through a fake document portal, email verification, a CAPTCHA and the Microsoft sign-in. The email address affected which visitors reached the credential page and which received harmless content.
A score decides who reaches the next page
One gate in our captures presents a single identity-verification checkbox. Its script starts with a score, then adjusts it for desktop or mobile behaviour, navigator.webdriver, installed plugins, inconsistent window dimensions and evidence of mouse, touch or scroll activity. A low score leads to a decoy. A passing score submits a hidden form that preserves the visitor's email address. The field names are randomized for each copy.
Another gate renders a fixed Turnstile challenge and submits its POST form as soon as the callback runs. Other builds gather WebGL and WebRTC details or unpack the next document from an obfuscated script. The screen can look almost empty while the gate decides which content to return.
Three captured branches follow the gate
The conventional branch shows a Microsoft sign-in and relays credentials and MFA responses. A device-code branch begins with a document page that displays and copies a user code, then opens Microsoft's device sign-in. Its controller polls for progress and can show a Microsoft-styled choice of push approval, one-time code, text message or call.
A separate update branch stores a complete page as Base64 text, turns it into a Blob URL and opens it in a new window. One captured version imitated a Microsoft Teams update, selected a download name from the visitor's operating system and included a credential form. The automatic download is part of the page behaviour; it is separate from the sign-in relay.
These branches share FlowerStorm attribution in our code matching, but a match identifies the branch present on that site. It does not mean every FlowerStorm site contains every flow.
What we see
| Month | New sites |
|---|---|
| September | 35 |
| October so far | 12 |
We captured 18 FlowerStorm sites since 25 September. 0 of them were running WordPress.
Finding the gate and branch
Record the exact URL, redirects, pop-up windows and network requests with test values. Search for a checkbox gate that scores navigator.webdriver, plugins, window dimensions and interaction events, or a Turnstile callback that immediately submits a hidden form. In the content stage, useful markers include next.php, device-code status polling, MFA-choice endpoints, window.blobHtmlContent, Base64 page markup and a Blob URL opened as a pop-up.