oauth device code phishing

OAuth device code phishing is a growing threat to Microsoft 365 users, as highlighted by FBI warnings in May 2026 about the Kali365 phishing-as-a-service platform. This attack abuses the legitimate OAuth device code authentication flow to steal access tokens and bypass multifactor authentication without capturing passwords. Instead of tricking victims into entering credentials on a fake page, attackers trick them into completing a real Microsoft sign-in on the attacker's device. This makes traditional anti-phishing advice like checking the URL insufficient. The Kali365 platform, distributed via Telegram, industrializes this trust-based attack, turning a convenient Microsoft sign-in feature into a serious account takeover vector.