Cybercriminals have developed a sophisticated phishing technique that exploits the OAuth device code flow to bypass multi-factor authentication (MFA) in Microsoft 365 accounts. This method allows attackers to gain unauthorized access without directly stealing user credentials.
The OAuth device code flow is designed to facilitate authentication on devices that cannot display a standard login interface, such as smart TVs or meeting-room systems. In this process, the device generates a short code, which the user enters on a separate device to approve access. Once approved, the device receives the necessary session tokens to access the service.
In the observed attack, adversaries initiate the device code flow by generating a legitimate code and then craft phishing messages that prompt victims to enter this code on Microsoft’s genuine sign-in page. These messages often masquerade as document-sharing requests or account verification notices, making them appear credible.
When the victim enters the code and completes the MFA process, Microsoft issues access and refresh tokens. However, due to the attacker’s manipulation, these tokens are sent to the attacker’s system instead of a trusted device. This grants the attacker full access to the victim’s Microsoft 365 account, including services like Outlook and OneDrive.
Once inside, attackers can perform various malicious activities, such as registering rogue devices, creating inbox rules to hide their presence, and using the compromised account to launch further phishing campaigns. This method is particularly insidious because it leverages legitimate authentication processes, making detection challenging.
To mitigate such threats, organizations should implement additional security measures beyond MFA. Continuous monitoring of authentication patterns, user behavior analytics, and educating users about emerging phishing tactics are crucial steps in enhancing security posture.
This development underscores the evolving nature of cyber threats and the need for adaptive security strategies. As attackers find new ways to exploit authentication processes, organizations must remain vigilant and proactive in safeguarding their digital assets.
