Microsoft 365 Device Code Phishing Bypasses MFA for Account Takeover

Key Takeaways

• A sophisticated phishing campaign is actively targeting Microsoft 365 users.
• The attack exploits Microsoft’s legitimate Device Code authentication flow, bypassing traditional MFA protections.
• Threat actors gain full account control without ever stealing a password, making detection difficult for users.
• Security researchers have identified unique indicators of compromise (IoCs), including specific network traffic patterns and a YARA rule for detection.

Microsoft 365 Device Code Phishing Campaign Bypasses MFA

A new, highly effective phishing campaign has emerged, targeting Microsoft 365 users by exploiting a legitimate authentication feature to gain unauthorized account access. This method, termed Device Code phishing, represents a significant evolution from typical password-stealing attacks, as it allows attackers to bypass multi-factor authentication (MFA) and seize control of accounts without ever directly asking for user credentials.

Instead of attempting to trick users into divulging their passwords on a fake login page, this campaign manipulates victims into unknowingly completing a genuine Microsoft authentication process. This surreptitious approach grants attackers access to the victim’s account, making the attack exceptionally difficult for average users to identify.

How the Device Code Phishing Attack Works

The Device Code flow is a standard Microsoft authentication mechanism designed for scenarios where traditional password entry is cumbersome, such as on smart TVs or command-line interfaces. Users are typically directed to a specific Microsoft URL and prompted to enter a short, device-specific code. This campaign weaponizes this helpful feature, transforming it into a trap to authorize an attacker-controlled device for account access.

Analysts at ReversingLabs have thoroughly documented this ongoing campaign. Their research highlights a combination of expertly crafted business-themed email lures, a sophisticated phishing kit, and the abuse of Microsoft’s Device Authorization Grant flow. This synergy enables what appears to be a routine Microsoft login, leading to a near-invisible account takeover.

According to a report by ReversingLabs researchers, shared with Cyber Security News (CSN), threat actors have refined this technique to bypass conventional security measures, making the malicious activity indistinguishable from a legitimate Microsoft login process.

The attack sequence typically begins with a phishing email, often disguised as an urgent approval request from a vendor or business associate. Clicking an embedded image in the email redirects the victim to a convincing fake landing page that meticulously mimics Microsoft’s official design. On this page, victims are instructed to copy a short code and then navigate to a genuine Microsoft device login page to enter it. At this stage, most users have no reason to suspect foul play, believing they are simply completing a standard authentication step.

Once the victim enters the code and completes their legitimate sign-in, Microsoft’s authentication system unknowingly authorizes the attacker’s device. The victim perceives no unusual activity, while the attacker simultaneously obtains a valid access token for the Microsoft 365 account. This token enables the attacker to access emails, files, and potentially move laterally within the victim’s organization.

Advanced Phishing Kit Evades Detection

The phishing kit underpinning this campaign is engineered for stealth and evasion. Its landing pages incorporate invisible Unicode characters, such as Zero Width Space, Word Joiner, and Zero Width Non-Joiner, strategically interspersed within words that security tools commonly flag as phishing indicators. This technique significantly complicates detection via traditional signature-based methods.

Further enhancing its legitimacy, the kit leverages Akamai’s infrastructure to host the device login entry point. The backend of the phishing kit also sends a POST request to the phishing host every four seconds, orchestrating the OAuth flow between the attacker and the victim’s authentication session. This consistent beacon is one of the few discernible network-level indicators of the ongoing attack.

Network traffic analysis can further aid in detection. Distinct clusters of hostname resolutions associated with the phishing landing page and the legitimate Microsoft authentication flow are identifiable. A third cluster comprises the beacon activity, occurring every four seconds after the initial authentication phase begins. This provides security teams with a reliable signal to search for within their network logs.

What You Should Do

• Employee Training: Educate employees to be highly suspicious of any prompts asking them to copy and paste codes into a Microsoft login page, especially if the request comes unexpectedly.
• Monitor Entra ID Logs: Regularly monitor Microsoft Entra ID (formerly Azure AD) sign-in logs for Device Code grant usage, particularly if the sign-in originates from an unknown or unusual endpoint (i.e., not a recognized IoT device or command-line tool).
• Deploy Detections: Implement detections for the phishing kit artifacts detailed in the ReversingLabs report. This includes deploying the provided YARA rule for landing page identification and configuring network monitoring for the described traffic patterns.
• Review IoCs: Integrate the provided Indicators of Compromise (IoCs) into your security information and event management (SIEM) systems, firewalls, and other security tools for proactive blocking and detection.

Indicators of Compromise (IoCs):-

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.