[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f0b35T1FuHC9eh4RVUU4QLc03zgC0pGWrDUS7cyAExe0":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":17,"status":23,"created_at":24,"published_at":25,"article":26,"tags":30,"podcasts":43,"controls":44},"f0c584b5-51a1-4b87-ae26-f61a752cacd9","device-code-phishing-bypasses-mfa-by-abusing-legitimate-microsoft-auth-flow","f317cb3a-8360-4471-b957-2b2349938fbb","Device Code Phishing Bypasses MFA by Abusing Legitimate Microsoft Auth Flow","Attackers crafted a fake Microsoft Teams meeting invitation to lure an employee into completing a device code sign-in, a legitimate Microsoft authentication flow intended for input-constrained devices. By tricking the victim into entering an attacker-controlled code on Microsoft's real authentication page, the attacker obtained a valid OAuth session token without needing the user's password or MFA code directly. This attack is particularly dangerous because the victim interacts with a genuine Microsoft domain, making it nearly impossible to detect through URL inspection alone. The use of residential proxies further obscured attacker infrastructure, complicating detection and attribution efforts.","**Immediate actions:**\n- Block or restrict the device code authentication flow (OAuth 2.0 device authorization grant) in Azure AD Conditional Access policies for users who do not require it.\n- Train employees to recognize unsolicited meeting invitations and to never enter authentication codes prompted by unexpected or unverified communications.\n- Review and revoke suspicious active OAuth tokens and sessions in your identity provider immediately upon suspicion of compromise.\n\n**Long-term improvements:**\n- Enforce Conditional Access policies that restrict token issuance to compliant, managed devices and known geographic locations.\n- Implement phishing-resistant MFA methods (e.g., FIDO2\u002Fpasskeys) that cannot be replayed or redirected by device code abuse.\n- Establish a formal process for users to report suspicious authentication requests, with a clear escalation path to the security team.\n\n**Detection measures:**\n- Monitor identity provider logs for device code authentication flows initiated from unexpected IP ranges, especially residential proxies.\n- Alert on OAuth token grants that are followed by access from a different IP or device than the one that initiated the sign-in.\n- Deploy user behavior analytics to flag anomalous post-authentication activity such as unusual data access or lateral movement.",[12,13,14,15,16],"MITRE ATT&CK T1528: Steal Application Access Token","NIS2 Article 21(2)(j)","NIS2 Article 21(2)(g)","NIST SP 800-53 IA-11: Re-authentication","CIS Control 6: Access Control Management",{"NIS2 Article 21(2)(g)":18,"NIS2 Article 21(2)(j)":19,"NIST SP 800-53 IA-11: Re-authentication":20,"CIS Control 6: Access Control Management":21,"MITRE ATT&CK T1528: Steal Application Access Token":22},"This point mandates basic cyber hygiene and security training, and the attack succeeded because the employee was not trained to recognize or refuse unexpected device code authentication prompts.","This point requires organizations to implement multi-factor authentication and secured communications; enforcing phishing-resistant MFA and restricting device code flows would have prevented the attacker from obtaining a usable session token.","This control requires re-authentication under specific conditions, and enforcing device-bound or context-aware re-authentication would have limited the attacker's ability to silently reuse the stolen session token.","This control calls for managing and restricting authentication mechanisms; disabling the device code OAuth grant for users who do not need it would have eliminated the attack vector entirely.","This technique directly describes how attackers abuse OAuth device code flows to obtain valid access tokens without credential theft, which is exactly the method used in this incident.","published","2026-11-13T08:22:33.198645+00:00","2026-11-13T08:22:33.154+00:00",{"id":7,"url":27,"slug":28,"title":29},"https:\u002F\u002Fwww.helpnetsecurity.com\u002F2026\u002F11\u002F13\u002Fmicrosoft-teams-device-code-phishing\u002F","how-attackers-turned-a-teams-meeting-booking-into-a-device-code-phishing-trap-a964a8","How attackers turned a Teams meeting booking into a device code phishing trap",[31,37],{"id":32,"name":33,"slug":34,"description":35,"color":36},"1ec88fde-2d0f-4ed8-932a-33f5ccc0fdc7","Access Control","access-control","Excessive privileges, missing MFA, weak auth","#f97316",{"id":38,"name":39,"slug":40,"description":41,"color":42},"7261eb8f-acd4-4d93-a489-7fdd652ec0ea","Security Awareness","security-awareness","Phishing, social engineering, human error","#22c55e",[],[45,49,53],{"slug":46,"name":47,"problem":48},"phishing-resistant-mfa","Phishing-resistant MFA","A stolen password, or a user who taps Approve on a push prompt, is no longer enough to log in.",{"slug":50,"name":51,"problem":52},"email-security","Email security","Phishing, malware and invoice fraud are filtered out before they reach inboxes.",{"slug":54,"name":55,"problem":56},"security-awareness-training","Security awareness training and phishing simulation","People recognise and report attacks instead of falling for them."]