Device Code Phishing Campaign Targets Microsoft 365 via OAuth Device Authorization Grant Abuse — Threadlinqs Intelligence
As of 2026-07-18, Device Code Phishing Campaign Targets Microsoft 365 via OAuth Device Authorization Grant Abuse is a high-severity phishing threat, tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 19 indicators of compromise.
Threat ID: TL-2026-1492 · Severity: HIGH · Status: ACTIVE · Category: PHISHING
ReversingLabs documents an active, unattributed phishing campaign that abuses Microsoft's legitimate OAuth 2.0 Device Authorization Grant flow to hijack Microsoft 365 / Entra ID accounts without
The campaign begins with phishing emails carrying HTML attachments styled as business documents (e.g., vendor estimates/quotes). The HTML references JPG lure imagery via Content-ID URLs wrapped in clickable anchor tags with algorithmically generated ID parameters, evading static content matching. Clicking through lands the victim on a ClickFix-style page requesting 'document review,' which displays a verification/device code and instructs the victim to copy it and sign in via Microsoft. The sign-in button opens a genuine Microsoft authentication popup (via window.open() to the legitimate aka.ms/devicelogin, Akamai-hosted) — the victim enters the phishing-supplied device code into Microsoft's own, real interface. On completion, the victim unknowingly authorizes the attacker's registered device against their account, granting the attacker OAuth access/refresh tokens without ever touching or transmitting the victim's password. This is a device-code variant of adversary-in-the-middle (AiTM) phishing: rather than proxying credentials through a fake portal, the attacker relays a legitimate device-authorization code and lets Microsoft's real infrastructure do the authentication, which lets the campaign sail past classic anti-phishing detections that look for spoofed login pages or credential-harvesting POSTs. The phishing kit's backend polls for device-code completion via POST requests roughly every four seconds using URL-safe base64 encoding, mirroring the standard OAuth device-flow polling interval used by legitimate CLI/IoT clients. Technical/evasion notables: the landing-page HTML embeds invisible Unicode formatting characters — Zero Width Space (U+200B), Word Joiner (U+2060), and Zero Width Non-Joiner (U+200C) — inside high-signal words such as 'Agreement,' 'Verify,' and 'Microsoft' to defeat keyword-based phishing detection. A bitshifted artifact string tied to Microsoft Entra ID's Security Token Service ('EvoStsArtifacts') appears in the page and requires a left-shift-by-6-bits transform before base64 decoding, an anti-analysis/obfuscation touch. Infrastructure abuses Cloudflare Workers (*.workers.dev subdomains) alongside a rotating set of freshly registered or compromised domains (300+ URLs catalogued by ReversingLabs) to host landing pages and evade domain-reputation blocking, while calling out to genuinely Microsoft-owned endpoints (aka.ms, login.microsoftonline.com, aadcdn.msftauth.net, login.live.com, browser.events.data.microsoft.com) for the real authentication leg — producing a DNS/network fingerprint that blends malicious and legitimate Microsoft traffic. No CVE or software vulnerability is involved; this is pure abuse of a legitimate, MFA-adjacent authentication flow designed for input-constrained devices (smart TVs, CLIs) that was never intended to be surfaced to end users via a phishing lure. The technique class is not new — Microsoft's Storm-2372 (a suspected Russia-aligned actor) has run device-code phishing against government, NGO, defense, telecom, and energy-sector targets since August 2024, evolving by February 2025 to register attacker devices and mint Primary Refresh Tokens for deeper persistence — and a broader wave of OAuth device-code phishing (340+ M365 organizations across five countries) was reported by industry researchers in March 2026, with Microsoft publishing a follow-up on an AI-enabled variant in April 2026. The ReversingLabs campaign analyzed here is a distinct, unattributed cluster sharing the same technique class, landing-page kit style (ClickFix), and infrastructure-abuse patterns (workers.dev) as those broader waves, but the source does not attribute it to Storm-2372 or any other named actor.
Target sectors: technology, manufacturing, finance, health, professional-services
Target regions: North America, Europe
Detections & IOCs
As of 2026-08-10, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 19 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
PHISHING, HIGH, threat intelligence, cybersecurity, T1583.006, T1584.001, T1566.001, T1566.002, T1204.001, T1098.005, T1550.001, T1027, T1102, T1036
