Quick Summary
Threat groups, including those linked to Russia and China, are increasingly using OAuth 2.0 device code phishing attacks to compromise Microsoft 365 accounts. Since September, these attacks have surged, exploiting legitimate Microsoft authentication processes to gain access to user accounts. This trend poses significant risks for organizations and individuals, as it can lead to account takeovers and data exfiltration.
The Securityish Brief
State-sponsored and financially motivated threat groups are leveraging Microsoft’s OAuth 2.0 device authorization grant flow for phishing attacks targeting M365 accounts. Since September, researchers from Proofpoint have observed a notable increase in these attacks, which utilize social engineering tactics to convince users to input their credentials into what appears to be a legitimate Microsoft authentication portal.
Two notable campaigns tracked by Proofpoint include one on December 8 that used a Google Share URL to lure users into a phishing trap, and another by the financially motivated group TA2723, which began in October with messages impersonating corporate notices. These campaigns often employ malicious OAuth applications and QR codes to facilitate the attack.
The rise of device code phishing is concerning because it bypasses traditional security measures that protect against fake login pages. As organizations become more aware of conventional phishing techniques, attackers are adapting their methods, making it crucial for users to remain vigilant.
Understanding the Attack Mechanism
In these phishing campaigns, users receive messages containing URLs or QR codes that lead them to a legitimate Microsoft device authorization page. Once users enter their device code, the attackers gain access to their M365 accounts. This method is particularly stealthy, as it does not require users to input credentials on a fake page, making it harder to detect.
Tools like SquarePhish and Graphish are commonly used in these attacks, allowing scammers to create convincing phishing pages. The campaigns often involve multi-channel targeting, utilizing email, SMS, and chat services to reach potential victims.
As state-aligned actors increasingly adopt these tactics, organizations and individuals must be aware of the evolving threat landscape. The use of device code phishing signifies a shift in how attackers approach account takeover, emphasizing the need for enhanced security measures.
Key Takeaways
- Be cautious of unexpected messages asking for device codes or authentication prompts.
- Verify the legitimacy of URLs before clicking, especially those that appear to lead to Microsoft services.
- Educate your team about the risks of device code phishing and how to recognize phishing attempts.
- Implement multi-factor authentication (MFA) to add an extra layer of security to M365 accounts.
- Regularly review and monitor account access logs for any suspicious activity.
Key Terms & Concepts
- OAuth 2.0: In this article, OAuth 2.0 refers to an authorization framework that allows third-party applications to obtain limited access to user accounts.
- Device Code Phishing: Device code phishing is a technique where attackers trick users into entering authentication codes on legitimate-looking pages to gain access to their accounts.
- TA2723: TA2723 is a financially motivated threat group known for using customized phishing messages to target users for account takeover.
Read the original article here: https://securityboulevard.com/2025/12/surge-of-oauth-device-code-phishing-attacks-targets-m365-accounts/
Your 5-Minute Securityish Brief
A weekly digest of cybersecurity news, phishing alerts, privacy tips, and emerging threats, simplified so anyone can understand what matters and why.
Securityish
Securityish explains cybersecurity, scams, data breaches, and privacy risks in simple language so you know what’s happening and how to protect yourself.
© 2026 Securityish
