Hackers Abuse “Device Codes” to Bypass Security and Seize Microsoft 365 Accounts

Hackers are abusing “Device Codes” to bypass security and seize Microsoft 365 accounts,according to Proofpoint Threat Research Team in a new report. The technique, dubbed Device Code Phishing, leverages the OAuth 2.0 device authorization grant flow, which is intended for devices with limited input capabilities, by sending phishing emails with a code and a link to the official Microsoft login portal (microsoft[.]com/devicelogin).

Attackers hijack this process to prompt users to enter a device code on the trusted Microsoft portal, enabling a malicious application to obtain a token that grants persistent access to the victim’s Microsoft 365 account, potentially enabling data exfiltration and other misuse without requiring the user’s password in future sessions.

The report notes that the campaigns rely on social engineering, often using lures with embedded URLs or QR codes, and that MFA and FIDO keys are being leveraged by organisations as defenses, pushing attackers toward abusing valid authorization flows. Proofpoint researchers also warn that abuse of OAuth authentication flows is likely to grow with broader adoption of MFA controls.