Microsoft 365 Under Siege: Phishers Hijack Device Codes to Bypass Security

The familiar blue Microsoft login screen has become a weapon in the hands of cybercriminals. In a chilling evolution of phishing tactics, attackers are exploiting a little-known authentication feature-OAuth device codes-to silently breach Microsoft 365 accounts, bypassing even multifactor authentication and leaving victims none the wiser.

Fast Facts

• Attackers are abusing Microsoft’s OAuth 2.0 Device Authorization Grant flow to hijack M365 accounts.
• Phishing emails lure users to enter device codes at genuine Microsoft login pages, authorizing malicious apps.
• Toolkits like SquarePhish2 and Graphish automate and legitimize the attack sequence.
• Both financially motivated groups and state-aligned actors, including suspected Russian hackers, are using this method.
• Experts urge organizations to block device code flows and educate users about new phishing risks.

The Anatomy of a Device Code Heist

It starts with a simple email-perhaps a notification about a “Salary Bonus” or a shared document. But behind the enticing subject line is a sophisticated ruse. The message contains a link or QR code, leading the target to Microsoft’s legitimate device login page. Here, a device code-disguised as a one-time password-is presented, and the user is instructed to enter it, believing they’re securing their account or accessing new benefits.

But the reality is far more sinister. By entering the code, the user unwittingly grants a rogue application-controlled by the attacker-full access to their Microsoft 365 account. No passwords are stolen, no security alerts are triggered, and even multifactor authentication is sidestepped. The attacker now holds an OAuth token, opening the door to emails, files, and sensitive data for as long as the access lasts.

This method, once the preserve of advanced red teams and targeted espionage, erupted into mainstream cybercrime in late 2025. Attackers now wield automated frameworks like SquarePhish2, which uses QR codes and staged redirects to make the entire process feel authentic. Some campaigns even send follow-up emails with fake verification codes to cement the illusion of legitimacy.

Meanwhile, toolkits like Graphish leverage Microsoft’s own Azure infrastructure to intercept authentication tokens in real time, deepening the threat. The financially driven group TA2723 has deployed these techniques at scale, while state-linked actors-such as the Russia-aligned UNK_AcademicFlare-have used them to target government officials and academics across the West.

Proofpoint, the cybersecurity firm tracking these campaigns, warns that the mass abuse of trusted authentication flows marks a dangerous new chapter in phishing. Organizations are urged to clamp down on device code authorization in their security policies and to train staff to recognize the subtle warning signs-never trust a device code from an unexpected source, no matter how legitimate the page may look.

Conclusion: Trust Exploited, Defenses Tested

As cyber attackers exploit the very mechanisms designed to keep us safe, the line between legitimate and malicious grows ever more blurred. The surge in device code phishing is a stark reminder: even the most trusted authentication methods are only as secure as the people and processes behind them. Vigilance, education, and proactive controls are the new frontline in the battle for digital identity.

WIKICROOK

• OAuth: OAuth is a protocol that lets users give apps access to their accounts without sharing passwords, improving security but also posing some risks.
• Device Authorization Grant: A secure OAuth 2.0 method allowing users to authorize devices with limited input by entering a code on a separate device with a browser.
• Phishing: Phishing is a cybercrime where attackers send fake messages to trick users into revealing sensitive data or clicking malicious links.
• Reverse Proxy: A reverse proxy is a server that sits between users and a web service, hiding the service’s real location and protecting it from direct attacks.
• Conditional Access: Conditional Access enforces security policies that restrict access based on factors like user location, device, or risk level to block unauthorized sign-ins.