When checking the URL isn’t enough: a Device Code Phishing attack via a Microsoft website

1. Executive summary

A phishing campaign observed from early April to mid-May 2026 abuses the OAuth 2.0 Device Authorization Grant (Device Code Flow) to hijack Microsoft 365 accounts. Attackers trick users into entering a one-time code on Microsoft's legitimate login.microsoftonline.com domain, bypassing traditional URL-checking anti-phishing advice and MFA. The attacker harvests OAuth access_token, refresh_token, and id_token, enabling persistent access to Outlook, OneDrive, and Teams. EMEA financial services are exposed wherever the Device Code Flow is enabled in Microsoft Entra ID and users can be social-engineered into completing the flow.

2. Regulatory framing

3. Technical analysis & attack chain

Attack chain (confirmed from Securelist reporting)

1. Initial access — phishing email. Victim receives an email styled as a notice from a law firm (first campaign) or as an order confirmation / quote notification (second campaign). The first campaign attached a password-protected PDF; the second embedded a link directly in the email body.
2. Redirect via legitimate domain. In the first campaign, the PDF contained a link pointing to a legitimate Microsoft address with URL parameters configured to redirect the user to attacker-controlled infrastructure. In the second campaign, the email embedded a link to cacoo.com (a legitimate Nulab-owned diagramming platform) which functioned as an open redirect to the phishing site.
3. CAPTCHA filtering. The phishing landing page featured multiple CAPTCHAs, presumably deployed to filter out security crawlers and automated analysis tools.
4. Device code delivery. The attacker's server-side application had already fetched a user_code by sending a POST request to https://login.microsoftonline.com/{tenant}/oauth2/v2.0/devicecode with the attacker's registered client_id and scope. The final phishing page instructed the user to copy this one-time code. Clicking the displayed code automatically copied it to the clipboard.
5. Redirect to legitimate Microsoft authentication. Simultaneously, the user was redirected to Microsoft's official authentication page (verification_uri, e.g., https://microsoft.com/devicelogin) where they were prompted to paste and enter the code.
6. MFA completion on legitimate Microsoft page. The victim completed the full MFA process directly on Microsoft's official page. No fake login page was presented — the user saw Microsoft's real sign-in and consent screens, potentially including their organisation's branding.
7. Token harvest. Upon successful authentication, the attacker's polling application received access_token, refresh_token, and id_token from https://login.microsoftonline.com/{tenant}/oauth2/v2.0/token (grant_type: urn:ietf:params:oauth:grant-type:device_code).
8. Persistence and access. The attacker used the refresh_token to silently renew access_token (which expires after ~1 hour) without further user interaction, maintaining persistent access. Observed capabilities: read and send email from the victim's mailbox, exfiltrate files from OneDrive, access Teams conversations.

Technical specifics

• Protocol abused: OAuth 2.0 Device Authorization Grant (RFC 8628)
• Microsoft endpoints involved: https://login.microsoftonline.com/{tenant}/oauth2/v2.0/devicecode (code request), https://login.microsoftonline.com/{tenant}/oauth2/v2.0/token (token polling), https://microsoft.com/devicelogin (user-facing verification page)
• Token types compromised: access_token (data access), refresh_token (persistent renewal), id_token (user profile data including name and email)
• Token lifetime: access_token expires after ~1 hour; refresh_token enables indefinite renewal until revoked or expired
• Polling error codes during pending auth: authorization_pending, slow_down
• Legitimate domains abused as redirects: Microsoft (login.microsoftonline.com with redirect parameters), cacoo.com (open redirect)
• Campaign scope: Early April to mid-May 2026; limited scope; threat actor continues active adaptation targeting new geographic regions including Brazil

Corroborating context (single-sourced to Malwarebytes/Huntress; verify before enforcement)

The FBI has published a public service announcement warning about "Kali365," a phishing-as-a-service platform that uses device code phishing to bypass MFA and steal Microsoft 365 tokens. Kali365 has expanded beyond Microsoft 365 to target AWS, Okta, and Russian platforms. This indicates the Device Code Phishing technique is being productised and lowering the barrier to entry for low-skilled attackers. The Kali365 reporting is sourced from Malwarebytes and Dark Reading; the FBI PSA itself was not reviewed for this advisory.

Attribution: No named threat actor with a MITRE profile is identified in the verified reference data. Attribution is unconfirmed.

4. Mitigation & containment

P1 — Within 24 hours

1. Disable Device Code Flow globally if not required for business operations. In Microsoft Entra ID, navigate to Conditional Access policies and create a policy blocking Device Code Flow authentication. Alternatively, disable it via PowerShell: powershell Set-MsolCompanySettings -UsersPermissionToReadOtherUsersEnabled $true # Device Code Flow is controlled via Conditional Access or app registrations Verify with your Microsoft Entra ID admin which specific Conditional Access policy controls the Device Code Flow for your tenant.
2. Alert on DeviceCodeSignIn events. Configure Microsoft Sentinel or your SIEM to alert on all DeviceCodeSignIn events in Microsoft Entra ID sign-in logs. Flag any device code sign-in originating from unusual locations, IP ranges, or outside expected business hours.
3. Review active refresh tokens. If a compromise is suspected, revoke all active refresh tokens for the affected user: powershell Revoke-AzureADUserAllRefreshToken -ObjectId "user@domain.com" Force re-authentication across all sessions.

P2 — Within 72 hours

4. Enforce device compliance states. Configure Conditional Access policies requiring compliant or Entra ID-joined devices for all authentication, including token-based access. This blocks token replay from non-corporate devices.
5. Block open-redirect abuse on Cacoo.com. If Cacoo.com is not a business-approved service, block it at the web proxy / SWG. If it is approved, monitor for redirect parameter abuse (redirect_uri, return_url, next parameters after the ? in URLs).
6. Email security tuning. Deploy rules to flag password-protected PDF attachments from external senders, especially those styled as legal notices. Flag emails containing links to cacoo.com from unknown senders.
7. User awareness briefing. Alert staff that legitimate Microsoft authentication pages can be abused via Device Code Phishing. Key message: never enter a code at microsoft.com/devicelogin unless you personally initiated a device sign-in on a device you control (smart TV, printer, IoT hardware).

P3 — Within 7 days

8. Audit app registrations. Review all Microsoft Entra ID app registrations for unnecessary client_id values that could be abused to request device codes. Remove unused or legacy app registrations.
9. Implement token lifetime policies. Where supported, configure shorter refresh token lifetimes for high-risk accounts to limit the persistence window of any stolen tokens.
10. Hunt for historical compromise. Query Microsoft Entra ID sign-in logs for DeviceCodeSignIn events over the past 90 days. Correlate with unusual data access patterns in Exchange, OneDrive, and Teams audit logs.

5. Indicators of compromise

No indicators of compromise available in the source material. The Securelist report does not publish specific IOCs (IPs, domains, hashes, or email sender addresses). The attack infrastructure details (phishing landing page URLs, CAPTCHA pages) are described qualitatively but no concrete indicators are provided.

6. Detection

title: Microsoft Entra ID Device Code Sign-In from Unusual Location
id: 7a3c1f2e-8b4d-4a6e-9c2f-1d5e8a7b3c4f
status: experimental
description: Detects Device Code Flow sign-in events in Microsoft Entra ID, which may indicate Device Code Phishing
author: Adverse Trace
date: 2026/07/06
references:

    - https://securelist.com/microsoft-device-code-phishing-attack/120350/
logsource:
    product: microsoft
    service: azure_signinlogs
detection:
    selection:
        authenticationProtocol: deviceCode
        conditionalAccessStatus: "success"
    filter_known_devices:
        deviceDetail.trustType:

            - "EntraIDJoined"
            - "DomainJoined"
    condition: selection and not filter_known_devices
falsepositives:

    - Legitimate device code sign-ins from smart TVs, printers, IoT devices, or CLI tools (Azure CLI, PowerShell)
    - Users travelling to new locations
level: medium

title: Suspicious OAuth Token Refresh Activity Following Device Code Sign-In
id: 8b4d2f3e-9c5e-4b7f-0d3a-2e6f9b8c4d5f
status: experimental
description: Detects access token refresh activity originating from a device code flow sign-in, indicating potential persistent access via stolen refresh tokens
author: Adverse Trace
date: 2026/07/06
references:

    - https://securelist.com/microsoft-device-code-phishing-attack/120350/
logsource:
    product: microsoft
    service: azure_signinlogs
detection:
    selection_device_code:
        authenticationProtocol: deviceCode
        resultType: 0
    selection_refresh:
        authenticationProtocol: bearer
        signInActivityType: "interactive"
        timeframe: "1h"
    condition: selection_device_code | near selection_refresh
falsepositives:

    - Legitimate IoT device token refresh
level: medium

7. Sources

• Securelist (Kaspersky), "When checking the URL isn't enough: a Device Code Phishing attack via a Microsoft website," https://securelist.com/microsoft-device-code-phishing-attack/120350/, 2026-07-06
• Huntress, "We Need to Talk About Device Code Phishing," https://www.huntress.com/blog/tradecraft-tuesday-device-code-phishing-explained, (date not specified in source)
• Dark Reading, "FBI-Flagged Phishing Kit Kali365 Expands Its Reach," https://www.darkreading.com/cyber-risk/fbi-flagged-phishing-kit-kali365-expands-its-reach, (date not specified in source)
• Malwarebytes Labs, "Kali365 phishing kit bypasses MFA and steals Microsoft logins," https://www.malwarebytes.com/blog/scams/2026/05/kali365-phishing-kit-bypasses-mfa-and-steals-microsoft-logins, 2026-05

8. Adverse Trace position

This is a high-impact technique for EMEA financial services organisations using Microsoft 365. The attack bypasses MFA and traditional anti-phishing controls by abusing a legitimate Microsoft authentication flow on a legitimate Microsoft domain — no fake login page, no credential harvest, no malware required. The resulting refresh_token provides persistent, silent access to email, file storage, and collaboration data until tokens are explicitly revoked. No CVE is involved; this is a design feature of OAuth 2.0 Device Authorization Grant being weaponised. Attribution is unconfirmed — no named actor with a MITRE profile has been identified in the verified reference data. The Kali365 PhaaS connection (Malwarebytes, Dark Reading) suggests the technique is being productised, which will likely increase attack volume and lower the skill barrier. We are treating this as an active, evolving threat. We will monitor for campaign expansion into EMEA financial services targets, publish IOCs if they become available, and update clients on detection rule refinements as we validate them against client telemetry.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.