Device Code Phishing exploits the legitimate Microsoft Identity Platform’s Device Authorization Grant flow to trick users into authorizing malicious applications, allowing attackers to harvest sensitive session and refresh tokens.

Key Points

• The attack leverages the OAuth 2.0 Device Authorization Grant, a protocol designed for input-constrained devices like smart TVs and printers.
• Attackers prompt victims to enter a one-time code on the official Microsoft login page, which grants the attacker's application persistent access to the victim's account.
• Phishing campaigns often use open redirects on trusted domains, such as Cacoo.com, to bypass security filters and direct users to malicious landing pages.
• Once a victim completes the MFA process on the legitimate Microsoft portal, attackers gain access to OneDrive files, Teams conversations, and email accounts.
• Organizations can mitigate this risk by disabling the Device Code Flow via Microsoft Entra ID Conditional Access policies if it is not required for business operations.

Why it Matters

This attack method is particularly dangerous because it bypasses traditional security warnings by utilizing legitimate, trusted Microsoft infrastructure for the final authentication step. By weaponizing standard authorization workflows, threat actors can maintain long-term access to corporate environments while appearing to follow standard security procedures.