How Device Code Phishing Abuses OAuth to Steal Microsoft 365 Sessions
Summary
Device code phishing tricks users into approving attacker-generated login codes, giving attackers OAuth tokens that can bypass MFA. The article explains recent campaigns and outlines Conditional Access, device-registration monitoring, and other mitigations.
Key points
- Attackers generate device codes and use phishing lures to get victims to authorize them, handing attackers valid OAuth tokens.
- Stolen tokens can let attackers bypass MFA and exploit a legitimate sign-in flow that may not trigger familiar phishing warnings.
- Storm-2372 used device code phishing in February 2025 after building rapport with targets through messaging platforms.
- Huntress detected a campaign beginning March 2, 2026, targeting 344 organizations across six countries; it was later attributed to the EvilTokens phishing-as-a-service platform.
- The campaign used Railway.com as token-harvesting infrastructure and personalized lures delivered through multi-hop redirects.
- Recommended defenses include blocking device code flow with Conditional Access where feasible, monitoring new device registrations and suspicious token exchanges, and assessing operational exceptions such as Device Registration Service needs.
Article Details
- Topic
- Device code phishing attacks, including their OAuth token-theft mechanics, observed campaigns, and defensive mitigations.
People
Dave KleinatlandHuntress Principal Product Researcher who discussed device code phishing in the Tradecraft Tuesday episode.Jenko HwongHuntress Principal Product Researcher who discussed device code phishing in the Tradecraft Tuesday episode.Lindsey O'Donnell-WelchArticle author.Nestori SyynimaaIntroduced a device code phishing technique in 2020, according to the article.
Threat Actors
EvilTokensPhishing-as-a-service platform attributed to the March 2026 device code phishing campaign.Kali365Phishing-as-a-service platform reported to offer device code phishing.Storm-2372Suspected Russian nation-state threat actor that used device code phishing to steal OAuth tokens in February 2025.
Vendors
Products
Azure Resource ManagerOne key red flag is when Office app tokens are used against Azure Resource Manager.Microsoft 365 Apps for EnterpriseA familiar-looking login code can hand an attacker access to a Microsoft 365 account. See how device code phishing ranks on our Tragic Quadrant and why it deserves a plan.Microsoft Entra IDWe can’t talk about device code phishing mitigations without mentioning Conditional Access, a Microsoft Entra ID security feature that enforces access policies based on signals like user, location, device, and riskMicrosoft TeamsIn February 2025, Russian threat actor Storm-2372 used Microsoft Teams meeting invite lures to deliver device code phishing messages, stealing victims’ authenticated sessions.
Tools
Countries
AustraliaIn another incident starting March 2, 2026, Huntress detected a large-scale device code phishing campaign targeting 344 organizations across the US, Canada, Australia, New Zealand, and Germany.CanadaIn another incident starting March 2, 2026, Huntress detected a large-scale device code phishing campaign targeting 344 organizations across the US, Canada, Australia, New Zealand, and Germany.GermanyIn another incident starting March 2, 2026, Huntress detected a large-scale device code phishing campaign targeting 344 organizations across the US, Canada, Australia, New Zealand, and Germany.New ZealandIn another incident starting March 2, 2026, Huntress detected a large-scale device code phishing campaign targeting 344 organizations across the US, Canada, Australia, New Zealand, and Germany.
Industries
Defensea suspected Russian nation-state threat actor active since August 2024, has targeted governments, NGOs, defense, telecom, healthcare, and energy organizations across Europe, North America, Africa, and the Middle East.Energythreat actor active since August 2024, has targeted governments, NGOs, defense, telecom, healthcare, and energy organizations across Europe, North America, Africa, and the Middle East.Healthcarenation-state threat actor active since August 2024, has targeted governments, NGOs, defense, telecom, healthcare, and energy organizations across Europe, North America, Africa, and the Middle East.