Device Code Phishing Bypasses MFA by Abusing Legitimate Microsoft Auth Flow
Written by AI from the linked story. Not reviewed by an editor. How this works
Attackers crafted a fake Microsoft Teams meeting invitation to lure an employee into completing a device code sign-in, a legitimate Microsoft authentication flow intended for input-constrained devices. By tricking the victim into entering an attacker-controlled code on Microsoft's real authentication page, the attacker obtained a valid OAuth session token without needing the user's password or MFA code directly. This attack is particularly dangerous because the victim interacts with a genuine Microsoft domain, making it nearly impossible to detect through URL inspection alone. The use of residential proxies further obscured attacker infrastructure, complicating detection and attribution efforts.
Tactical Insight
Immediate actions
- Block or restrict the device code authentication flow (OAuth 2.0 device authorization grant) in Azure AD Conditional Access policies for users who do not require it.
- Train employees to recognize unsolicited meeting invitations and to never enter authentication codes prompted by unexpected or unverified communications.
- Review and revoke suspicious active OAuth tokens and sessions in your identity provider immediately upon suspicion of compromise.
Long-term improvements
- Enforce Conditional Access policies that restrict token issuance to compliant, managed devices and known geographic locations.
- Implement phishing-resistant MFA methods (e.g., FIDO2/passkeys) that cannot be replayed or redirected by device code abuse.
- Establish a formal process for users to report suspicious authentication requests, with a clear escalation path to the security team.
Detection measures
- Monitor identity provider logs for device code authentication flows initiated from unexpected IP ranges, especially residential proxies.
- Alert on OAuth token grants that are followed by access from a different IP or device than the one that initiated the sign-in.
- Deploy user behavior analytics to flag anomalous post-authentication activity such as unusual data access or lateral movement.