Executive Summary
ReversingLabs has identified an active phishing campaign targeting Microsoft 365 accounts by exploiting the legitimate Device Authorization Grant flow (OAuth 2.0). Unlike traditional phishing that hosts counterfeit login pages to steal passwords, this attack vector persuades victims to enter a malicious code into the official Microsoft device login portal, effectively authorizing an attacker-controlled device to access the victim's account without requiring their password.
The technical workflow involves a landing page that directs victims to legitimate Microsoft URLs such as aka.ms/devicelogin. Researchers identified over 700 active samples of these landing pages, indicating a high-volume and ongoing threat. By leveraging the victim's own successful authentication on their own device, attackers can bypass multi-factor authentication (MFA) and obtain valid access tokens for the target environment.
This campaign is particularly dangerous because it utilizes legitimate Microsoft infrastructure for the final authentication step, making it difficult for users to distinguish from valid IT requests. Organizations using Microsoft 365 should be aware of this bypass technique, which circumvents traditional credential-based detection and MFA protections.