Device code phishing leverages the OAuth 2.0 device authorization grant, originally designed for browserless devices like IoT or CLI tools, to bypass traditional security perimeters. Attackers initiate the flow to obtain a user code and trick victims into entering it on the official Microsoft device login page. Since the user performs a legitimate authentication on a trusted domain, the attack often sidesteps standard Conditional Access policies and MFA checks, leaving defenders with an OAuth token artifact as the only sign of compromise.
Once the victim authenticates, the attacker captures short-lived access tokens and long-lived refresh tokens. These tokens allow for extensive lateral movement within Microsoft 365 services, including Exchange Online and SharePoint, often leading to Business Email Compromise (BEC). Defenders can identify these attacks by hunting for the 'deviceCode' protocol in Entra ID sign-in logs and correlating them with suspicious activity like geographic IP splits or the immediate creation of malicious inbox rules.
To effectively mitigate this threat, organizations should prioritize blocking the device code flow via Conditional Access policies, granting access only by exception. Relying solely on MFA is insufficient, as the attack occurs during a valid MFA-enabled session. In incident response scenarios, it is critical to revoke user sessions and refresh tokens explicitly, as a password reset alone will not invalidate the active sessions captured by the threat actor.
Top comments (0)