Cybersecurity researchers have identified a sophisticated phishing campaign that exploits Microsoft’s Device Authorization Grant, commonly known as the Device Code Flow, to hijack user accounts. This method is particularly insidious because it leverages legitimate Microsoft authentication processes, making it challenging for users to detect the attack.
The Device Code Flow is designed to facilitate authentication on devices lacking traditional input methods, such as smart TVs or printers. Users authenticate by entering a code on a separate device, linking the two. Attackers have manipulated this process to gain unauthorized access to user accounts.
The attack sequence begins with the victim receiving a phishing email, often disguised as a legitimate communication from a trusted source. This email contains a password-protected PDF attachment, which, when opened, presents a link to a fake legal portal. This portal is crafted to appear authentic, complete with CAPTCHA checks to evade automated security scanners.
Upon interacting with the fake portal, the victim is instructed to copy a one-time code and paste it into the official Microsoft authentication page. Unbeknownst to the user, this action grants the attacker access tokens, allowing them to read and send emails, access OneDrive files, and view Teams conversations without needing the user’s password.
What makes this attack particularly effective is its ability to bypass traditional security measures. Since the final login occurs on Microsoft’s genuine authentication page, users are less likely to suspect malicious activity. Additionally, multi-factor authentication (MFA) offers limited protection in this scenario, as the attacker gains access through legitimate tokens.
Researchers have observed variations of this campaign targeting different regions. For instance, a variant aimed at Brazilian users replaced the PDF attachment with a link through a legitimate diagramming website, yet still directed victims to the same malicious process.
To mitigate the risk of such attacks, users should exercise caution when receiving unsolicited emails, especially those containing attachments or links requesting authentication actions. Verifying the authenticity of such communications through direct contact with the purported sender is advisable. Organizations should also educate employees about emerging phishing techniques and consider implementing additional security measures to detect and prevent unauthorized access.
This campaign underscores the evolving nature of phishing attacks, where adversaries continuously adapt their methods to exploit legitimate processes. Staying informed about these tactics is crucial for both individuals and organizations to maintain robust cybersecurity defenses.
