2 posts
An active Microsoft 365 phishing campaign is abusing the OAuth 2.0 Device Authorization Grant flow to achieve account takeover without stealing passwords. The attack utilizes ClickFix-style landing pages with Unicode obfuscation and tricks victims into authorizing an attacker-controlled device via legitimate Microsoft authentication portals, coordinating the flow via a 4-second beaconing mechanism.
Threat actors are increasingly utilizing OAuth Device Code phishing to compromise Microsoft 365 accounts. By tricking victims into entering a verification code on the legitimate Microsoft device login page, attackers can obtain OAuth access and refresh tokens without ever harvesting the user's credentials. This technique bypasses traditional phishing defenses by operating over encrypted channels and legitimate Microsoft infrastructure.
