Phishing Attacks Abuse OAuth Device Code to Gain Access to M365 Accounts

Proofpoint researchers have identified a significant surge in threat campaigns exploiting the Microsoft 365 (M365) OAuth device code authorization flow.

According to a new report, both state-aligned espionage groups and financially motivated cybercriminals are increasingly leveraging sophisticated phishing tools to trick users into granting attackers full access to their accounts.

While the technique of device code phishing is not entirely novel, Proofpoint observed a shift in September 2025, moving from limited red-team activity to widespread malicious campaigns.

The attack vector abuses a legitimate feature of Microsoft’s identity platform the OAuth 2.0 device authorization grant flow designed to allow devices with limited input capabilities (like smart TVs) to access M365 resources.

The attack typically begins with a social engineering lure delivered via email, often containing a malicious URL or QR code.

These lures frequently masquerade as security alerts, shared documents, or payroll notifications. When a victim interacts with the link, they are presented with a code and directed to the legitimate Microsoft verification URL (microsoft.com/devicelogin).

Because the login page is a genuine Microsoft domain, traditional phishing awareness training that emphasizes checking URLs often fails.

Believing they are completing a standard multi-factor authentication (MFA) or re-authorization step, the victim enters the code.

This action validates a token generated by the attacker, granting the threat actor access to the victim’s M365 account and potentially enabling data exfiltration, lateral movement, or persistence within the network.

Tools Lowering the Barrier to Entry

The rise in these attacks is facilitated by accessible, user-friendly tools such as SquarePhish2 and Graphish.

• SquarePhish2: An updated version of a tool released initially by Dell SecureWorks, SquarePhish2 allows attackers to automate the polling of Microsoft endpoints. It mimics the process of configuring Time-based One-Time Password (TOTP) authentication, redirecting users to legitimate Microsoft pages while the server initiates the unauthorized grant flow.
  
• Graphish: Available on criminal forums, this tool helps attackers create convincing phishing pages using Azure App Registrations and reverse proxy setups to conduct Adversary-in-the-Middle (AiTM) attacks.

Proofpoint is tracking multiple clusters utilizing these tactics. TA2723, a financially motivated actor, has been observed using “Salary Bonus” and fake OneDrive lures.

Researchers identified a campaign that used a shared document reminder alert to trick users into clicking a Google Share URL hyperlinked as text, to access a fictitious document called “Salary Bonus + Employer Benefit Reports 25.

In a campaign monitored in December, victims were directed to localized sites branded with their company’s logo, eventually prompting them to input a code into the Microsoft device login page under the guise of “secure authentication.”

Mitigations

On the espionage front, a suspected Russia-aligned group tracked as UNK_AcademicFlare has been targeting government, higher education, and military sectors.

Unlike the “spray and pray” tactics of cybercriminals, this group engages in patient rapport-building using compromised government email addresses before delivering the malicious payload via Cloudflare Worker URLs.

Proofpoint recommends that organizations block the device code flow entirely via Conditional Access policies if it is not required for business operations.

If blocking is not feasible, admins should restrict the flow to compliant devices or specific IP ranges. Furthermore, security teams must update user training to explicitly warn against entering codes on Microsoft’s login portal when prompted by unsolicited emails.

Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.