Hackers Exploit OAuth to Steal Microsoft 365 Credentials

Cybercriminals have found a way to exploit Microsoft’s OAuth device authorization flow to steal credentials from Microsoft 365 accounts, posing a significant threat to organizations worldwide. This technique, which takes advantage of a legitimate security feature, has been increasingly used since late 2024, leaving many security teams unprepared.

The Rise of Device Code Phishing

Device code phishing has become a prominent method for identity theft, evolving from a little-known tactic to a common tool in the cybercriminal arsenal. Proofpoint analysts reported in early 2025 that numerous campaigns have been launched targeting businesses across various sectors. These campaigns utilize device code phishing to obtain unauthorized access to Microsoft 365 accounts.

By leveraging the OAuth 2.0 device authorization flow, attackers can impersonate trusted Microsoft services, making it difficult for traditional security measures to detect these attacks. The technique involves directing victims to legitimate Microsoft pages where they unknowingly authorize access to their accounts by entering a provided code.

Understanding the Attack Method

Device code phishing specifically exploits devices with limited input capabilities, such as smart TVs and gaming consoles, to trick users into entering malicious codes. Attackers deliver these codes via emails containing PDF attachments or URLs that lead to the official Microsoft login page. Once the code is entered within the session window, hackers gain access to authentication tokens, allowing them to maintain control over the account even if passwords are changed.

This method requires minimal technical expertise, as it uses legitimate Microsoft APIs to produce device codes, which are then distributed through social engineering tactics. The seamless integration with Microsoft’s systems means the process lacks any obvious red flags, making it challenging for even savvy users to recognize the threat.

Preventative Measures and Future Outlook

As the adoption of device code phishing grows among various threat groups, including those using the Kali 365 toolkit and TA4903, organizations are advised to strengthen their defenses. Proofpoint recommends implementing conditional access policies to block device code flow and enforce the use of managed devices for authentication. Additionally, enhancing user education to address this specific phishing method is crucial, as traditional training does not cover this vulnerability.

The rise of proof-of-concept tools like ClickFix has lowered the entry barrier for less experienced criminals, accelerating the spread of device code phishing. This trend is expected to continue, affecting a broad range of targets from individual users to large enterprises. Organizations must remain vigilant and proactive in updating their cybersecurity strategies to mitigate this growing threat.

Stay informed with Cyber Security News for the latest updates on evolving cyber threats. Follow us on Google News, LinkedIn, and X to ensure you remain ahead in the fight against cybercrime.