TOKENFLARE

Summary from the TLDR InfoSec newsletter

TokenFlare is a serverless AITM phishing simulation framework targeting Entra ID/M365. Its core logic is just 530 lines of JavaScript. TokenFlare supports multiple OAuth flows, including Intune Conditional Access bypass techniques, and is deployable to Cloudflare Workers or a local HTTPS proxy, with built-in bot/scraper blocking and production-ready infrastructure, in under 60 seconds. The framework captures credentials, auth codes, and session cookies via configurable webhooks, uses modular campaign configuration for custom branding and URL structures, and includes Certbot integration for automated SSL certificate provisioning. Blue teams can detect TokenFlare via static IoCs: the HTTP header "X-TokenFlare: Authorised-Security-Testing" and the User-Agent "TokenFlare/1.0 For_Authorised_Testing_Only". They should monitor for serverless worker abuse, suspicious OAuth flows with rapid authentication handoffs, and webhook exfiltration patterns targeting M365 authentication tokens.