Hackers Exploit Microsoft Device Code Authentication Flow to Bypass MFA via Phishing Attack

Security researchers have uncovered a sophisticated phishing campaign that abuses Microsoft’s legitimate Device Code authentication flow to compromise Microsoft 365 accounts without stealing usernames or passwords directly.

Instead of harvesting credentials through fake login pages, attackers manipulate victims into completing a genuine Microsoft authentication process, including multi-factor authentication (MFA), ultimately granting attackers valid access tokens.

The campaign demonstrates how legitimate authentication mechanisms can be weaponized through social engineering, making it significantly harder for users to recognize the attack.

Hackers Exploit Microsoft Device Code Authentication Flow

The phishing activity was first identified by malware researcher Anurag (@MalwareHunterr), who discovered a malicious Microsoft-themed verification page hosted directly on a raw IP address instead of a traditional domain.

This approach allows threat actors to quickly deploy disposable phishing infrastructure while avoiding domain-based reputation systems and security blacklists.

Victims visiting the phishing page are instructed to verify their Microsoft account by entering a device code, creating the illusion of a standard Microsoft security verification process.

The attack specifically exploits Microsoft’s OAuth Device Code Flow, a legitimate authentication protocol designed for devices with limited input capabilities, such as smart TVs, gaming consoles, printers, IoT devices, and command-line applications.

Under normal circumstances, users receive a device code from a trusted application and enter it at Microsoft’s official device login portal to authorize access.

However, attackers abuse this workflow by first initiating a legitimate Device Code request themselves and then presenting the generated code to unsuspecting victims through phishing messages or fake verification pages.

Because victims authenticate directly on Microsoft’s official login portal, they see authentic Microsoft branding and are required to complete their normal password entry and MFA challenge.

This significantly increases the credibility of the attack since no fake login page or credential theft occurs. Once the victim successfully authorizes the device code, Microsoft issues OAuth access tokens and, in many cases, refresh tokens to the attacker-controlled session that originally generated the request.

With these tokens, attackers can immediately access Microsoft 365 resources, including Outlook, OneDrive, SharePoint, Teams, and other cloud services, depending on the permissions granted to the application.

Importantly, this attack does not cryptographically bypass MFA or exploit vulnerabilities within Microsoft’s authentication system. Instead, it relies entirely on deceiving users into approving an authentication request they did not initiate.

Since the victim willingly completes the MFA process, Microsoft’s security infrastructure treats the authentication as legitimate. This makes Device Code phishing particularly dangerous because it bypasses many traditional phishing detection techniques that focus primarily on credential theft or fake login pages.

Researchers identified the phishing infrastructure operating from the defanged IP address 159.198.44[.]67:5000, using the paths /start/3ee6d619 and /check/3ee6d619. Security teams are advised to immediately block these indicators across secure web gateways, DNS filtering solutions, endpoint protection platforms, email security systems, and threat intelligence tools.

The use of a raw IP address instead of a registered domain enables attackers to rotate infrastructure rapidly and evade reputation-based blocking mechanisms.

Microsoft recommends disabling or restricting the Device Code authentication flow wherever it is not operationally necessary.

Organizations should implement Microsoft Entra Conditional Access policies to limit Device Code authentication based on users, applications, geographic locations, or risk levels.

Security administrators should also continuously monitor Microsoft Entra sign-in logs for Device Code authentication events, unusual application authorizations, unexpected geographic login locations, and suspicious token activity.

User awareness remains a critical defense against this attack. Employees should never enter a Microsoft device code after receiving an unsolicited email, phone call, chat message, or website prompt.

Before approving any authentication request, users should carefully review the application requesting access and verify that they personally initiated the sign-in.

Organizations should also adopt phishing-resistant authentication methods such as FIDO2 security keys and passkeys, which strengthen identity protection even though Device Code attacks primarily exploit user authorization rather than password compromise.

Proper governance of Device Code authentication, combined with continuous monitoring and user education, remains essential for defending against this increasingly sophisticated phishing technique.