Quick Summary
Microsoft 365 accounts are facing a surge in phishing attacks that exploit the OAuth device code authorization mechanism. Attackers trick users into entering a device code on a legitimate Microsoft login page, granting access to their accounts without stealing credentials. Since September 2025, these attacks have escalated, involving threat actors like TA2723 and state-aligned groups targeting various sectors, including government and academia.
The Securityish Brief
Microsoft 365 accounts are currently under attack through a wave of phishing attempts that utilize the OAuth device code authorization mechanism. These attacks have been noted to increase significantly since September 2025, with threat actors such as TA2723 and a suspected Russia-aligned group known as UNK_AcademicFlare actively involved.
Attackers deceive victims into entering a device code on Microsoft’s legitimate device login page, which unwittingly authorizes an attacker-controlled application. This method allows them to bypass traditional security measures like multi-factor authentication (MFA) without needing to steal login credentials.
Proofpoint has identified various phishing campaigns employing this technique, including salary bonus attacks that use localized branding to lure victims into providing access. Another notable actor, TA2723, has shifted to using OAuth device code phishing since October, previously known for credential phishing through platforms like OneDrive and LinkedIn.
Additionally, the state-aligned group UNK_AcademicFlare has been observed using compromised government and military email accounts to build trust with victims before leading them into a phishing workflow. This activity primarily targets sectors such as government, academia, and transportation in the U.S. and Europe.
Organizations should take these developments seriously, as the increase in these sophisticated phishing attacks highlights a growing trend in cyber threats. The use of legitimate login pages adds a layer of complexity, making it harder for users to recognize phishing attempts.
To mitigate risks, organizations are encouraged to implement Microsoft Entra Conditional Access and establish policies regarding sign-in origins. These measures can help reduce the likelihood of unauthorized access through such phishing schemes.
Everyday users should remain vigilant and be cautious when entering device codes or responding to authentication requests, especially if they come from unexpected sources.
Key Takeaways
- Be cautious when entering device codes on login pages, ensuring they are legitimate.
- Implement Microsoft Entra Conditional Access to enhance security for Microsoft 365 accounts.
- Establish a policy regarding sign-in origins to prevent unauthorized access.
- Monitor account activity for any suspicious logins or authorization requests.
- Educate employees about recognizing phishing attempts, especially those involving device codes.
Key Terms & Concepts
- OAuth: In this article, OAuth refers to an authorization framework that allows third-party applications to access user accounts without sharing passwords.
- TA2723: TA2723 is a threat actor known for credential phishing attacks, previously targeting platforms like Microsoft OneDrive and LinkedIn.
- UNK_AcademicFlare: UNK_AcademicFlare is a suspected Russia-aligned threat actor that has been observed using OAuth device code phishing for account takeover.
- SquarePhish: SquarePhish is a publicly available red teaming tool that targets OAuth device grant authorization flows, mimicking legitimate Microsoft MFA setups.
- Graphish: Graphish is a malicious phishing kit that supports OAuth abuse and is shared on underground forums.
Read the original article here: https://www.bleepingcomputer.com/news/security/microsoft-365-accounts-targeted-in-wave-of-oauth-phishing-attacks/
Your 5-Minute Securityish Brief
A weekly digest of cybersecurity news, phishing alerts, privacy tips, and emerging threats, simplified so anyone can understand what matters and why.
Securityish
Securityish explains cybersecurity, scams, data breaches, and privacy risks in simple language so you know what’s happening and how to protect yourself.
© 2026 Securityish
