Quick Summary
Microsoft 365 users are facing device code authorization phishing attacks, which trick users into granting access tokens. Attackers exploit Microsoft’s OAuth 2.0 device authorization flow, allowing them to control enterprise accounts. This trend signifies a shift from basic password theft to more sophisticated methods that bypass multi-factor authentication protections.
The Securityish Brief
Microsoft 365 users are increasingly targeted by device code phishing attacks, as highlighted by Proofpoint. These attacks leverage the OAuth 2.0 device authorization grant flow, where users unknowingly grant access tokens to attackers. The campaigns are executed by both state-aligned and financially-motivated threat actors, often beginning with deceptive emails from compromised accounts.
In one instance, attackers used salary-themed notifications to entice users, while another campaign involved a benign email from a compromised Zambian government address aimed at a US university employee. Users are misled into entering a one-time passcode on the legitimate Microsoft device authorization page, inadvertently allowing attackers to take control of their M365 accounts.
This phishing technique is not new but is gaining traction among various threat clusters. Attackers employ tools like Squarephish and Graphish, which facilitate the creation of convincing phishing pages and enhance the effectiveness of their campaigns. By registering a domain and obtaining an SSL certificate, they increase the credibility of their phishing sites.
To combat these threats, organizations are advised to implement Conditional Access policies that block device code flows for all users. This can be done by first assessing the impact through historical sign-in logs before applying stricter measures. If complete blocking is not feasible, an allow-list approach can be adopted to limit device code authentication to approved users and environments.
As the abuse of OAuth authentication flows is expected to rise, organizations should remain vigilant and consider adopting FIDO-compliant multi-factor authentication controls to enhance security.
Key Takeaways
- Educate employees about recognizing device code phishing attacks to prevent unauthorized access.
- Implement Conditional Access policies to block device code flows for all users where possible.
- Monitor sign-in logs to assess the impact of any new security policies before full deployment.
- Consider an allow-list approach for device code authentication to limit access to trusted users and devices.
- Adopt FIDO-compliant multi-factor authentication controls to strengthen security against evolving threats.
Key Terms & Concepts
- OAuth 2.0: In this article, OAuth 2.0 refers to an authorization framework that allows applications to obtain limited access to user accounts.
- Device Code Phishing: Device code phishing is a technique where attackers trick users into granting access tokens through misleading prompts.
- Conditional Access: Conditional Access is a security feature that enforces policies based on user identity, device state, and location.
Read the original article here: https://www.helpnetsecurity.com/2025/12/18/microsoft-365-device-code-phishing/
Your 5-Minute Securityish Brief
A weekly digest of cybersecurity news, phishing alerts, privacy tips, and emerging threats, simplified so anyone can understand what matters and why.
Securityish
Securityish explains cybersecurity, scams, data breaches, and privacy risks in simple language so you know what’s happening and how to protect yourself.
© 2026 Securityish
