Critical Microsoft 365 Flaw Lets Attackers Bypass MFA, Hijack Sessions
Key Takeaways A new phishing technique bypasses Multi-Factor Authentication (MFA) in Microsoft 365 by exploiting the OAuth device-code flow. Attackers trick users into completing a legitimate...
Key Takeaways
- A new phishing technique bypasses Multi-Factor Authentication (MFA) in Microsoft 365 by exploiting the OAuth device-code flow.
- Attackers trick users into completing a legitimate Microsoft sign-in and MFA, then steal the resulting session tokens.
- This method allows attackers to hijack active Microsoft 365 sessions without directly compromising user credentials.
- The attack enables threat actors to register rogue devices, manipulate mailboxes, and propagate further phishing attempts.
- Disabling the OAuth device-code flow where unnecessary is a primary mitigation, alongside enhanced monitoring and user awareness.
Attackers Exploit Microsoft 365 OAuth Device-Code Flow to Bypass MFA
Multi-factor authentication (MFA) is a cornerstone of modern cybersecurity, designed to thwart unauthorized access even if primary credentials are stolen. However, a recently identified phishing campaign demonstrates a sophisticated method to circumvent MFA protections in Microsoft 365 environments. This technique leverages the legitimate OAuth device-code flow, persuading users to authenticate a genuine Microsoft sign-in and subsequently hijack the entire session without ever directly compromising their passwords.
Table Of Content
The OAuth device-code flow is a feature intended for devices with limited input capabilities, such as smart TVs or conference room systems, where displaying a full login interface is impractical. Attackers are now abusing this convenience feature, turning it into a potent MFA bypass.
How the Device-Code Phishing Attack Works
The attack begins with a deceptive lure, often a convincing document-sharing request or an account verification prompt, which includes a unique code. Victims are then instructed to enter this code on Microsoft’s authentic sign-in page. Crucially, the user completes their password and MFA checks on a legitimate Microsoft domain, believing they are securely accessing a service.
According to Trend Micro said in a report, the critical flaw lies in how the session tokens are delivered. Instead of being sent to the victim’s trusted device, the approved session tokens are redirected to the attacker’s system. This effectively hands over an authenticated session to the threat actor.
In a standard device-code sign-in, a device initiates a request for a short code, and the user enters this code on a separate screen to authorize access. Microsoft then securely issues session tokens to the originating device, maintaining a legitimate connection between the user and their device.
The malicious actors disrupt this connection by impersonating the device itself. Their server requests a valid, temporary code. Simultaneously, a phishing email or message prompts the victim to use this code to access a shared document or verify their account. The victim, interacting with a genuine Microsoft login page, enters the code, provides their credentials, and successfully completes MFA. Once this authentication is complete, Microsoft issues access and refresh tokens to the attacker’s pending request. These tokens grant the attacker full access to Outlook and other Microsoft 365 resources. The longer-lived refresh token ensures persistent access, even after the victim closes their browser. This approach differs significantly from traditional OAuth device code abuse, which primarily focuses on password theft, as it directly steals an already authenticated session.
Real-World Campaign Example
One observed operation highlighted a sophisticated social engineering approach. Instead of a generic, unsolicited email, attackers engaged in rapport building, impersonating a law-firm partner. After exchanging several friendly messages, the attacker sent a link, making the request appear to be part of an ongoing legitimate business conversation.
The link, while seemingly familiar, led through a complex chain of redirects involving a Google Sites page, compromised open redirectors, and a fake human-check prompt designed to evade automated analysis. The final page mimicked a document portal and instructed the target to input a displayed verification code into the authentic Microsoft sign-in page.
Detecting and Responding to Intrusion
Investigators documented a case where an attacker gained access from an overseas location within hours of the victim’s approval. The threat actor then registered multiple rogue devices, established a hidden mailbox rule to conceal replies and bounce messages, and subsequently used the compromised mailbox to launch further phishing campaigns against external contacts. Such an incident is challenging to detect with endpoint-focused security tools alone.
Administrators must scrutinize device-code sign-ins, especially in environments where this workflow is not explicitly required. Key indicators of compromise include:
- Authentication Broker activity originating from an unfamiliar country or an unmanaged device.
- Rapid registration of new devices.
- Unexpected alterations to mailbox rules.
- Impossible travel alerts, indicating login attempts from geographically disparate locations in a short timeframe.
These signals, when correlated, can reveal an ongoing account takeover. The risk of covert mail manipulation is further underscored by the use of hidden mailbox rules.
What You Should Do
- Disable Unnecessary OAuth Device-Code Flow: The most effective proactive measure is to disable the OAuth device-code flow across your organization where it is not absolutely essential. Implement narrow, documented exceptions only where truly required.
- Limit Device Registration: Restrict the ability for users to register new devices within your Microsoft 365 environment.
- Enforce Managed Devices: Require access to sensitive data and applications only from managed and compliant devices.
- Implement Location-Aware Controls: Utilize conditional access policies to enforce location-based access restrictions and flag impossible travel scenarios.
- Revoke Sessions on High Risk: Configure automated policies to revoke user sessions when sign-in risk scores increase, indicating potential compromise.
- Enhance User Awareness Training: Educate employees to recognize and report suspicious requests, particularly those asking them to enter or read out a code, even if the login page appears legitimate. Emphasize that an approved login does not automatically guarantee security.
- Migrate to Phishing-Resistant MFA: Where feasible, transition to phishing-resistant MFA methods such as FIDO2 security keys, which are less susceptible to these types of session hijacking attacks.
No Comment! Be the first one.