device code phishing

Device code phishing is a sophisticated attack technique that abuses legitimate OAuth device-code authentication flows to bypass multifactor authentication (MFA) and steal access tokens, particularly targeting Microsoft 365 accounts. Recent FBI warnings highlight the Kali365 phishing-as-a-service platform, which tricks users into completing a real Microsoft sign-in flow for an attacker's device, capturing tokens without requiring passwords. Russian state-linked groups such as Storm-2372 have also exploited this method in campaigns against government and human rights organizations. These attacks demonstrate that MFA alone is insufficient, as attackers leverage trusted authentication workflows to compromise Outlook, Teams, and OneDrive. Defending against device code phishing requires hardening identity infrastructure, adopting zero-trust principles, and educating users to recognize authorization requests that are not typical sign-ins.