# Microsoft Entra ID Device Code Phishing — OAuth 2.0 Device Authorization Grant Abuse (Storm-2372, EvilTokens, Kali365)

> Adversaries abuse Microsoft's legitimate OAuth 2.0 device authorization grant flow: they generate device codes with first-party public client IDs (Azure CLI, Microsoft Authentication Broker, Microsoft Office) and use phishing lures to trick users into entering those codes at microsoft.com/devicelogin, harvesting valid access and refresh tokens that bypass MFA. The technique is used by Russian nation-state actor Storm-2372 and by the EvilTokens and Kali365 phishing-as-a-service platforms against Entra ID / Microsoft 365 tenants.

- **Published:** 2026-06-25T00:00:00Z
- **Last reviewed:** 2026-06-25T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0943
- **ID:** TL-2026-0943
- **Severity:** HIGH
- **Category:** PHISHING
- **Status:** ACTIVE
- **Actor:** Storm-2372 (Russia)
- **Detections:** 9 · **IOCs:** 26 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Device code phishing weaponizes the OAuth 2.0 device authorization grant (RFC 8628), a flow designed for input-constrained devices (TVs, IoT, CLI tools). In the legitimate flow a device requests a device_code and a short human-readable user_code from the authorization server, displays the user_code with a verification URL (microsoft.com/devicelogin), and polls the token endpoint until the user approves on a second device; it then receives a scoped, time-limited, revocable access token. Because the flow is a Microsoft first-party, fully legitimate sign-in, it produces no consent prompt and no application warning.

In the attack, the adversary plays the role of the 'device.' The attacker initiates a device_code request against login.microsoftonline.com/oauth2/v2.0/devicecode using a public first-party client ID that requires no app registration or secret — most commonly Azure CLI (04b07795-8ddb-461a-bbee-02f9e1bf7b46), the Microsoft Office client (d3590ed6-52b3-4102-aeff-aad2292ab01c), or, for device-registration abuse, the Microsoft Authentication Broker (29d9ed98-a469-4536-ade2-f981bc1d605e). The attacker wraps the resulting user_code and the genuine microsoft.com/devicelogin URL into a convincing lure (Teams/meeting invite, document-share notice, voicemail, RFQ/bid solicitation, DocuSign, Microsoft Forms) delivered by email or via messaging services (Microsoft Teams, WhatsApp, Signal). When the victim enters the code and authenticates — often silently via existing SSO — the attacker's polling loop instantly receives a valid access_token and refresh_token. Because the tokens are stolen rather than the password, multi-factor authentication is satisfied during the legitimate sign-in and provides no protection.

Storm-2372 (suspected Russian state-aligned, active since August 2024) ran a campaign documented by Microsoft in February 2025, impersonating prominent contacts to build rapport before sending device-code lures, then using the stolen tokens for Microsoft Graph email harvesting (searching mailboxes for keywords such as username, password, admin, teamviewer, anydesk, credentials, secret, ministry, gov). On 14 February 2025 Microsoft documented an evolution: Storm-2372 shifted to the Microsoft Authentication Broker client ID to obtain a refresh token for the device registration service and register attacker-controlled devices in Entra ID, yielding a Primary Refresh Token (PRT) for durable access, while using region-appropriate proxies to blend in. The EvilTokens phishing-as-a-service platform — launched publicly on Telegram on 16 February 2026 with tiered email-delivery, token-capture, and SMTP-relay services and AI-assisted lure customization — ran a large-scale campaign observed from 19 February through mid-March 2026 against 340+ Microsoft 365 organizations across the US, Canada, Australia, New Zealand, and Germany, using Railway.com as the token-harvesting backend behind Cloudflare Workers and Vercel redirect chains. The Kali365 PhaaS platform likewise incorporates device code phishing. Defensive controls center on Conditional Access policies that block the device code flow (including the 'Other clients' / authenticationProtocol = deviceCode condition), phishing-resistant MFA (FIDO2/passkeys), device-registration restrictions, and revocation of refresh tokens via revokeSignInSessions on suspected compromise.

## MITRE ATT&CK

- T1583 Acquire Infrastructure
- T1587 Develop Capabilities
- T1608 Stage Capabilities
- T1598 Phishing for Information
- T1566 Phishing
- T1528 Steal Application Access Token
- T1606 Forge Web Credentials
- T1556 Modify Authentication Process
- T1550 Use Alternate Authentication Material
- T1098 Account Manipulation
- T1526 Cloud Service Discovery
- T1087 Account Discovery
- T1114 Email Collection
- T1534 Internal Spearphishing
- T1102 Web Service
- T1090 Proxy
- T1567 Exfiltration Over Web Service

## Sources

- [Tradecraft Tuesday: Device Code Phishing Explained](https://www.huntress.com/blog/tradecraft-tuesday-device-code-phishing-explained)
- [Storm-2372 conducts device code phishing campaign](https://www.microsoft.com/en-us/security/blog/2025/02/13/storm-2372-conducts-device-code-phishing-campaign/)
- [Defending against evolving identity attack techniques](https://www.microsoft.com/en-us/security/blog/2025/05/29/defending-against-evolving-identity-attack-techniques/)
- [CSA Research Note: OAuth Device Code Phishing Hits 340+ Microsoft 365 Organizations](https://labs.cloudsecurityalliance.org/research/csa-research-note-oauth-device-code-phishing-m365-20260325-c/)
- [Approved by Design. Abused by Attackers: Inside Device Code Flow Exploitation](https://guardz.com/blog/approved-by-design-abused-by-attackers-inside-device-code-flow-exploitation/)
- [MFA Didn't Fail, the Trust Model Did: Device Code Phishing and OAuth Token Theft (Kali365)](https://cside.com/blog/mfa-token-theft-device-code-phishing-trust-model)
- [Detecting device code phishing attacks in Azure: from exploitation to detection](https://www.silverfort.com/blog/device-code-attacks-in-azure-from-exploitation-to-detection/)
- [Entra ID OAuth Phishing via First-Party Microsoft Application](https://www.elastic.co/guide/en/security/8.19/entra-id-oauth-phishing-via-first-party-microsoft-application.html)
- [Go With the Flow: Abusing OAuth Device Code Flow](https://www.levelblue.com/blogs/spiderlabs-blog/go-with-the-flow-abusing-oauth-device-code-flow)
- [Storm-2372 Launches Device Code Phishing Campaign Targeting Microsoft 365 Accounts](https://www.quorumcyber.com/threat-intelligence/storm-2372-launches-device-code-phishing-campaign-targeting-microsoft-365-accounts/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0943