Device Code Phishing: Turning a Convenience Feature Into an MFA Bypass
Device code phishing exploits the OAuth 2.0 device authorization grant, a legitimate authentication feature designed for input-limited devices like smart TVs. Attackers initiate a device-code request with Microsoft, receive a valid code, then trick victims into approving it through social engineering. The victim authenticates on genuine Microsoft pages and completes MFA, but the session tokens are issued to the attacker instead. When targeting the Microsoft Authentication Broker, attackers can register rogue devices and obtain long-lived refresh tokens for persistent access. A recent campaign used sophisticated multi-stage delivery chains involving Google Sites, compromised website redirectors, and fake document-sharing portals. After successful authentication, attackers registered multiple devices, created hidden mailbox rules, and used compromised accounts to send additional phishing emails, all without touching victim endpoints.
AI Analysis
Technical Summary
This threat exploits the OAuth 2.0 device authorization grant flow by initiating a device code request and using social engineering to convince victims to authenticate on genuine Microsoft pages. Despite victims completing multi-factor authentication, the session tokens are issued to the attacker, effectively bypassing MFA protections. When targeting the Microsoft Authentication Broker, attackers can register unauthorized devices and obtain long-lived refresh tokens, allowing persistent access to victim accounts. The attack campaigns employ sophisticated multi-stage delivery mechanisms, including Google Sites, compromised website redirectors, and fake document-sharing portals. After successful authentication, attackers register multiple rogue devices, create hidden mailbox rules to evade detection, and use compromised accounts to propagate further phishing emails, all without direct interaction with victim endpoints.
Potential Impact
Successful exploitation results in attackers bypassing MFA protections and gaining unauthorized access to Microsoft accounts. Attackers can maintain persistent access through long-lived refresh tokens and perform actions such as registering rogue devices and creating hidden mailbox rules. Compromised accounts are then used to send additional phishing emails, facilitating further compromise and lateral phishing campaigns. The attack does not require endpoint compromise, increasing stealth and persistence.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Organizations should monitor official Microsoft advisories for updates on mitigations or fixes related to device code phishing. Until official guidance is available, user education on recognizing social engineering attempts and suspicious authentication requests is critical. Implementing conditional access policies that restrict device registrations and monitoring unusual device registration activity may help reduce risk. Additionally, reviewing mailbox rules and suspicious email activity can aid in early detection of compromise.
Indicators of Compromise
- domain: html.phish.microsoft
- domain: cholaw-kr.co
- domain: rlcounsel.com
- domain: up88qope1z.hlpadditives.com
- domain: zr6dgshpvf.flosli.com
- domain: eusei.com
- domain: zrdesignlabo.com
- domain: profileupdate-collaboration.stefan-dufva.workers.dev
Device Code Phishing: Turning a Convenience Feature Into an MFA Bypass
Description
Device code phishing exploits the OAuth 2.0 device authorization grant, a legitimate authentication feature designed for input-limited devices like smart TVs. Attackers initiate a device-code request with Microsoft, receive a valid code, then trick victims into approving it through social engineering. The victim authenticates on genuine Microsoft pages and completes MFA, but the session tokens are issued to the attacker instead. When targeting the Microsoft Authentication Broker, attackers can register rogue devices and obtain long-lived refresh tokens for persistent access. A recent campaign used sophisticated multi-stage delivery chains involving Google Sites, compromised website redirectors, and fake document-sharing portals. After successful authentication, attackers registered multiple devices, created hidden mailbox rules, and used compromised accounts to send additional phishing emails, all without touching victim endpoints.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This threat exploits the OAuth 2.0 device authorization grant flow by initiating a device code request and using social engineering to convince victims to authenticate on genuine Microsoft pages. Despite victims completing multi-factor authentication, the session tokens are issued to the attacker, effectively bypassing MFA protections. When targeting the Microsoft Authentication Broker, attackers can register unauthorized devices and obtain long-lived refresh tokens, allowing persistent access to victim accounts. The attack campaigns employ sophisticated multi-stage delivery mechanisms, including Google Sites, compromised website redirectors, and fake document-sharing portals. After successful authentication, attackers register multiple rogue devices, create hidden mailbox rules to evade detection, and use compromised accounts to propagate further phishing emails, all without direct interaction with victim endpoints.
Potential Impact
Successful exploitation results in attackers bypassing MFA protections and gaining unauthorized access to Microsoft accounts. Attackers can maintain persistent access through long-lived refresh tokens and perform actions such as registering rogue devices and creating hidden mailbox rules. Compromised accounts are then used to send additional phishing emails, facilitating further compromise and lateral phishing campaigns. The attack does not require endpoint compromise, increasing stealth and persistence.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Organizations should monitor official Microsoft advisories for updates on mitigations or fixes related to device code phishing. Until official guidance is available, user education on recognizing social engineering attempts and suspicious authentication requests is critical. Implementing conditional access policies that restrict device registrations and monitoring unusual device registration activity may help reduce risk. Additionally, reviewing mailbox rules and suspicious email activity can aid in early detection of compromise.
Technical Details
- Author
- AlienVault
- Tlp
- white
- References
- ["https://www.trendmicro.com/en_us/research/26/g/device-code-phishing.html"]
- Adversary
- null
- Pulse Id
- 6a61c32adbac47eb19574196
- Threat Score
- null
Indicators of Compromise
Domain
| Value | Description | Copy |
|---|---|---|
domainhtml.phish.microsoft | — | |
domaincholaw-kr.co | — | |
domainrlcounsel.com | — | |
domainup88qope1z.hlpadditives.com | — | |
domainzr6dgshpvf.flosli.com | — | |
domaineusei.com | — | |
domainzrdesignlabo.com | — | |
domainprofileupdate-collaboration.stefan-dufva.workers.dev | — |
Threat ID: 6a6231af9c2644c7f847146f
Added to database: 07/23/2026, 15:22:23 UTC
Last enriched: 07/23/2026, 16:29:05 UTC
Last updated: 07/23/2026, 22:56:33 UTC
Views: 13
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.