Executive Summary
A recent surge in phishing campaigns demonstrates how adversaries are abusing the legitimate Microsoft OAuth 2.0 Device Authorization Grant specification (Device Code Flow). In these attacks, victims are coerced into entering a one-time 'user_code' into the official Microsoft authentication portal. This bypasses traditional MFA and security checks because the user is interacting directly with the trusted `microsoft.com` domain. Once the victim approves the request, the attacker obtains long-lived tokens for persistent access to emails, OneDrive files, and Teams conversations.
Several prominent APT groups, including ToddyCat, Cloud Atlas, Kimsuky, and OceanLotus, have been observed leveraging variations of this technique and associated tools like Umbrij and PebbleDash. Campaigns have targeted a range of sectors globally, with recent adaptations specifically focusing on Brazilian users via open redirects on platforms like Cacoo. The attack is particularly effective because it circumvents the standard security advice of checking for malicious domain names.