In early 2026, a phishing campaign abuses Microsoft's OAuth 2.0 Device Authorization Grant (Device Code Flow) to gain unauthorized access to user accounts. Attackers send phishing emails containing Mailchimp Mandrill service links that lead to fake Adobe-themed sites. These sites exploit legitimate Microsoft authentication mechanisms to acquire access and refresh tokens, granting persistent delegated access to critical Microsoft 365 resources like Graph API, Teams, Outlook, and SharePoint. The technique exploits shared client IDs across tenants and family of client IDs (FOCI) to facilitate lateral movement. Two attack variants are described: one leveraging external phishing infrastructure with dynamic device code generation, and another relying on fake meeting invitations containing pre-generated device codes. The campaign's reliance on legitimate Microsoft services complicates detection and mitigation efforts. There is no indication of a patch or official fix, and no known exploits in the wild have been reported.

Successful exploitation results in attackers obtaining persistent delegated access tokens, allowing unauthorized access to sensitive Microsoft 365 resources including Graph API, Teams, Outlook, and SharePoint. This can lead to credential theft, token hijacking, and lateral movement within and across tenants. The attack bypasses traditional security controls by abusing legitimate Microsoft authentication flows, increasing the difficulty of detection and response. However, no known active exploits in the wild have been reported at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since this attack relies on phishing and abuse of legitimate OAuth flows, mitigation should focus on user awareness training to recognize phishing attempts, monitoring for unusual OAuth token issuance, and applying conditional access policies that limit device code flow usage or require additional verification. Organizations should also monitor for suspicious domains and URLs related to the campaign indicators. No official fix or patch has been indicated in the provided data.