Microsoft Device Code Phish Steals Tokens, Not Passwords

How the attack worked

The attack begins with an email that claims Microsoft detected unusual sign-in activity and urges the recipient to secure their account immediately. Instead of linking directly to a fake Microsoft login page, the email sends the victim to an attacker-controlled verification site first. That site displays a device code and instructions, along with a button that opens Microsoft's genuine Device Login page at login.microsoftonline.com.

The victim enters the code on Microsoft's real domain and clicks Continue, believing they are verifying or protecting their account. In reality, they are approving an authorization request for an attacker-controlled application. Once approved, the attacker receives a valid Microsoft access token rather than a password, which can be used through Microsoft Graph to reach resources such as email, OneDrive, SharePoint, and Teams, depending on the permissions granted.

Why it succeeded

This technique is effective because it abuses a legitimate Microsoft authentication workflow rather than imitating it. Every critical step, including the sign-in itself, happens on Microsoft's real domain, which removes the usual visual cues people are trained to spot, like misspelled URLs or fake login pages. The attacker-controlled site only handles the initial redirect and code display, while Microsoft's own infrastructure handles the sensitive part of the flow, making it harder for victims to sense anything is wrong.

What to watch for

• Unexpected emails about unusual sign-in activity that push for immediate action
• Being sent to a third-party "verification portal" before reaching any Microsoft page
• A prompt to enter a device code you did not request
• An authorization or consent screen for an application you don't recognize

Building resistance

Organizations and individuals can reduce risk from this technique by treating any unrequested device-code or authentication prompt as suspicious and verifying it through a separate, trusted channel before proceeding. Employees should be reminded that seeing Microsoft's legitimate domain during a login flow is not proof the overall request is safe, since attackers can trigger real login steps as part of a larger scheme. Regularly reviewing and removing unfamiliar applications connected to a Microsoft account, and revoking sessions and permissions quickly if an unexpected approval occurs, can limit the damage if someone does approve a request by mistake. Security and IT teams should also reinforce awareness of urgency-based lures, such as claims of unusual sign-in activity, since this pressure tactic is central to getting victims to act without pausing to verify.

What is device code phishing?

It is a phishing technique where a victim is led to enter a code on Microsoft's legitimate device login page, unknowingly authorizing an attacker-controlled application to access their account.

Does device code phishing steal passwords?

No, the attacker captures a valid Microsoft access token rather than a password, which can then be used to access Microsoft 365 resources like email, OneDrive, and Teams.

Why is this attack considered effective?

Because every key step, including the actual sign-in, happens on Microsoft's real login domain, which makes the flow look trustworthy even though the victim is authorizing an attacker's app.

How can someone tell they were targeted by this?

Red flags include receiving an unexpected urgent email about unusual sign-in activity, being sent to a separate verification site before reaching Microsoft, and being asked to approve access to an app the user did not intend to connect.