Executive Summary
Device code phishing exploits the OAuth 2.0 device authorization grant, a feature designed for input-limited devices like smart TVs. In this attack, an adversary generates a legitimate Microsoft authentication code and tricks a victim into entering it on a genuine Microsoft login page. Because the user authenticates on a trusted domain, traditional MFA is satisfied, but the resulting session tokens are issued to the attacker's infrastructure rather than the victim's device.
Recent campaigns demonstrate high sophistication, utilizing multi-stage delivery chains that involve social engineering, Google Sites hosting, and open redirects on compromised legitimate domains to bypass security filters. Once access is gained, attackers have been observed registering rogue devices and implementing hidden mailbox rules to maintain persistence and facilitate follow-on phishing attacks, often without ever touching the victim's physical endpoint.