Executive Summary
Modern threat actors are increasingly shifting away from traditional credential harvesting toward OAuth-based authorization attacks. By leveraging legitimate Microsoft device-code flows, attackers trick users into authorizing rogue sessions on authentic identity provider pages, effectively bypassing Multi-Factor Authentication (MFA). Since the victim authenticates through a valid Microsoft portal, traditional URL reputation and password-theft detection mechanisms often fail to identify the threat.
Technical analysis reveals that these campaigns use sophisticated browser-side evasion, including AES-GCM encrypted payloads and anti-analysis scripts, to hide malicious content from static security scanners. Once the user enters the provided code, an OAuth access token is issued directly to the attacker, granting persistent access to sensitive resources like Outlook, OneDrive, and Teams. This method eliminates the need for the attacker to ever handle the victim's password, making recovery through simple password resets ineffective.
This threat is particularly critical for organizations relying heavily on cloud-based collaboration suites. The impact includes unauthorized data exfiltration and potential lateral movement within identity resources. Security teams should focus on browser-level runtime analysis and monitoring for unusual device-code authentication events.