Phishing Attacks Exploiting OAuth Device Code Authorization for Microsoft 365 Account Takeover
Threat actors are increasingly leveraging OAuth 2.0 device code authorization flows to compromise Microsoft 365 accounts through sophisticated phishing campaigns. Proofpoint researchers have observed both state-aligned and financially motivated groups using social engineering tactics to trick users into granting access to malicious applications, resulting in account takeovers, data exfiltration, and broader SaaS supply chain abuse. Attackers initiate these campaigns with phishing messages containing URLs or QR codes that, when followed, prompt users to authorize access for rogue applications, ultimately handing over OAuth tokens to the adversaries.
Industry analysis highlights that identity-first intrusions, including device code flow phishing and illicit OAuth consent, have driven significant data breaches and business email compromise incidents in 2025. Notable cases include the exploitation of connected apps to exfiltrate data from Salesforce tenants and major financial impacts on organizations such as Marks & Spencer. Security experts recommend enforcing phishing-resistant MFA, governing OAuth consent, and deprecating device code flows where feasible to mitigate these risks. Regulatory changes are also pushing organizations to strengthen identity and SaaS governance in response to these evolving threats.
Timeline
Jan 1, 2026
Device code phishing activity surges in 2026
Reporting in 2026 described a major increase in device code phishing attacks. Attackers were using the technique to steal access tokens and bypass standard access controls, making phishing operations more effective.
Dec 16, 2025
Proofpoint publishes findings on widespread Microsoft 365 device code phishing
Proofpoint publicly reported that multiple state-aligned and financially motivated threat clusters were abusing the OAuth 2.0 device authorization grant to compromise Microsoft 365 accounts. The report highlighted tooling such as SquarePhish, SquarePhish2, and Graphish, and recommended restricting or blocking device code flow with Conditional Access and compliant-device requirements.
Oct 1, 2025
TA2723 adopts device code phishing with salary and document lures
In October 2025, financially motivated actor TA2723 began using device code phishing in campaigns themed around shared documents and salary-related files. Proofpoint assessed the actor likely used different tooling across campaign waves to scale the attacks.
Sep 1, 2025
Proofpoint observes broad surge in device code phishing activity
By September 2025, Proofpoint observed unusually widespread phishing campaigns abusing Microsoft's OAuth device code flow across multiple threat clusters. The campaigns targeted Microsoft 365 users and enabled account takeover, data theft, lateral movement, and persistence while bypassing MFA through legitimate Microsoft verification pages.
Sep 1, 2025
UNK_AcademicFlare starts rapport-based device code phishing campaign
By September 2025, the Russia-aligned cluster UNK_AcademicFlare was conducting device code phishing campaigns against targets in government, think tanks, higher education, and transportation in the U.S. and Europe. The group used compromised government and military email accounts plus Cloudflare Worker links spoofing OneDrive to lure victims into authorizing attacker access.
Jan 1, 2025
State-aligned actors begin using Microsoft device code phishing
Proofpoint tracks state-aligned use of OAuth 2.0 device authorization grant phishing against Microsoft 365 accounts beginning in January 2025. The activity included Russia-aligned operators using the legitimate Microsoft device login flow to obtain access tokens and take over accounts.
See the full picture in Mallory
Mallory subscribers get deeper analysis on every story, including:
Who’s affected and how
Deep-dive technical analysis
Actionable next steps for your team
IPs, domains, hashes, and more
Ask questions and take action on every story
Filter by topic, classification, timeframe
Get matching stories delivered automatically
Related Entities
Malware
Organizations
Affected Products
Sources
5 more from sources like cso online, bleeping computer, the hacker news, help net security and huntio blog
Related Stories
OAuth Device Code and Malicious App Abuse to Gain Persistent Access in Microsoft Entra ID/Microsoft 365
Threat actors are increasingly abusing **OAuth** in *Microsoft Entra ID* and *Microsoft 365* to obtain **access/refresh tokens** that provide durable access even when passwords are reset and MFA is enabled. Reported activity includes both (1) **malicious OAuth app** registrations and deceptive consent prompts that masquerade as legitimate “business integrations,” and (2) abuse of the **OAuth 2.0 Device Authorization Grant** (device code flow) where victims authenticate on Microsoft’s legitimate device login portal, making the intrusion harder to detect with credential-focused controls. Multiple reports describe campaigns targeting business users and organizations (including technology, manufacturing, and financial sectors) to access resources such as **Outlook, Teams, and OneDrive** and to enable mailbox actions and data access under seemingly legitimate application activity. Research and incident reporting highlight that attackers can persist via **service principals** created in victim tenants after consent is granted, and that some integrations may remain effective even if the consenting user is later disabled; separate reporting also describes **device-code vishing/phishing** that leverages legitimate Microsoft OAuth client IDs and standard login workflows to capture tokens without attacker-hosted phishing pages, with one source attributing the vishing activity to **ShinyHunters** (unconfirmed by Microsoft at the time of reporting).
1 months ago
OAuth Phishing and Malicious Application Abuse in Microsoft 365 Environments
Attackers are increasingly leveraging Microsoft Copilot Studio to facilitate OAuth phishing attacks by exploiting its ability to host customizable agents and redirect users to arbitrary URLs. Security researchers have demonstrated that Copilot Studio agents, which appear as legitimate Microsoft services, can be configured with a 'Login' button that redirects unsuspecting users to malicious OAuth consent pages. This technique increases the credibility of phishing attempts, as the initial interaction occurs on a trusted Microsoft domain, making it more likely for users to grant permissions to malicious applications. Once a user consents, attackers can exfiltrate OAuth tokens, granting them persistent access to sensitive data and services within the victim's Microsoft 365 environment. The flexibility of Copilot Studio, while beneficial for legitimate automation, also provides attackers with a powerful tool to craft convincing phishing lures and automate token exfiltration. Security experts emphasize the importance of reviewing and tightening Entra ID application consent policies, especially in light of recent and upcoming policy updates from Microsoft. Despite improvements in consent policy enforcement, risks remain, particularly when users with elevated privileges, such as Application Administrators, are able to grant broad permissions. In parallel, security researchers have highlighted the prevalence of hidden malicious OAuth applications within Microsoft 365 tenants. Open-source tools like Cazadora have been developed to help administrators audit their environments for suspicious applications, such as those with anomalous names or reply URLs. Common indicators of malicious OAuth apps include names mimicking user accounts, generic test names, or non-alphanumeric strings, as well as reply URLs pointing to local loopback addresses. The discovery of even a single suspicious app often signals a broader compromise, underscoring the need for comprehensive audits. Security teams are urged to regularly inspect both Enterprise Applications and Application Registrations for signs of abuse. The combination of sophisticated phishing techniques using Copilot Studio and the widespread presence of malicious OAuth apps represents a significant threat to Microsoft 365 environments. Proactive monitoring, user education, and strict consent policies are critical to mitigating these risks. Organizations should remain vigilant for new attack vectors that exploit trusted cloud services. The evolving landscape of OAuth-based attacks requires continuous adaptation of security controls and incident response strategies. Collaboration between security researchers and cloud service providers is essential to stay ahead of emerging threats. The integration of automation and AI-driven services like Copilot Studio into enterprise environments necessitates a reevaluation of traditional security assumptions. As attackers continue to innovate, defenders must leverage both technical controls and threat intelligence to protect their organizations.
1 months ago
EvilTokens Turns Microsoft Device Code Phishing Into a Scalable Account Takeover Service
Researchers identified **EvilTokens** as a new phishing-as-a-service platform built to hijack **Microsoft 365** accounts by abusing Microsoft’s legitimate OAuth 2.0 **device code** authentication flow. Sold and operated through Telegram bots, the service gives affiliates phishing templates, email harvesting and reconnaissance features, automated Microsoft API interactions, webmail access, and mailbox triage capabilities. Victims are lured into entering attacker-supplied device codes on Microsoft’s real login page, allowing attackers to capture access and refresh tokens—and in some cases a **Primary Refresh Token**—without stealing passwords or directly defeating MFA. Security teams linked a sharp rise in device code phishing to EvilTokens, describing it as the first known turnkey PhaaS offering dedicated Microsoft device code phishing pages and warning that it lowers the barrier for low-skill operators. More than **1,000 phishing domains** were observed by late March, with campaigns affecting organizations worldwide and notable activity in the United States, Australia, Canada, France, India, Switzerland, and the United Arab Emirates; finance, HR, and transportation/logistics staff were highlighted as frequent targets. Researchers from Sekoia and Mnemonic urged defenders to disable or restrict unnecessary device code flows in **Microsoft Entra ID**, monitor device code grant sign-ins for anomalies, train users on device authentication abuse, and revoke refresh tokens when compromise is suspected.
4 weeks ago