# Device Code Phishing Campaign Targets Microsoft 365 via OAuth Device Authorization Grant Abuse

> ReversingLabs documents an active, unattributed phishing campaign that abuses Microsoft's legitimate OAuth 2.0 Device Authorization Grant flow to hijack Microsoft 365 / Entra ID accounts without stealing passwords. Business-themed lures direct victims to a ClickFix-style landing page that walks them through entering an attacker-supplied device code into the genuine Microsoft login flow, silently authorizing an attacker-controlled device and granting persistent account access.

- **Published:** 2026-07-18T00:00:00Z
- **Last reviewed:** 2026-07-18T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1492
- **ID:** TL-2026-1492
- **Severity:** HIGH
- **Category:** PHISHING
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 19 (full data via the Threadlinqs MCP server — Purple tier)

## Description

The campaign begins with phishing emails carrying HTML attachments styled as business documents (e.g., vendor estimates/quotes). The HTML references JPG lure imagery via Content-ID URLs wrapped in clickable anchor tags with algorithmically generated ID parameters, evading static content matching. Clicking through lands the victim on a ClickFix-style page requesting 'document review,' which displays a verification/device code and instructs the victim to copy it and sign in via Microsoft. The sign-in button opens a genuine Microsoft authentication popup (via window.open() to the legitimate aka.ms/devicelogin, Akamai-hosted) — the victim enters the phishing-supplied device code into Microsoft's own, real interface. On completion, the victim unknowingly authorizes the attacker's registered device against their account, granting the attacker OAuth access/refresh tokens without ever touching or transmitting the victim's password. This is a device-code variant of adversary-in-the-middle (AiTM) phishing: rather than proxying credentials through a fake portal, the attacker relays a legitimate device-authorization code and lets Microsoft's real infrastructure do the authentication, which lets the campaign sail past classic anti-phishing detections that look for spoofed login pages or credential-harvesting POSTs. The phishing kit's backend polls for device-code completion via POST requests roughly every four seconds using URL-safe base64 encoding, mirroring the standard OAuth device-flow polling interval used by legitimate CLI/IoT clients. Technical/evasion notables: the landing-page HTML embeds invisible Unicode formatting characters — Zero Width Space (U+200B), Word Joiner (U+2060), and Zero Width Non-Joiner (U+200C) — inside high-signal words such as 'Agreement,' 'Verify,' and 'Microsoft' to defeat keyword-based phishing detection. A bitshifted artifact string tied to Microsoft Entra ID's Security Token Service ('EvoStsArtifacts') appears in the page and requires a left-shift-by-6-bits transform before base64 decoding, an anti-analysis/obfuscation touch. Infrastructure abuses Cloudflare Workers (*.workers.dev subdomains) alongside a rotating set of freshly registered or compromised domains (300+ URLs catalogued by ReversingLabs) to host landing pages and evade domain-reputation blocking, while calling out to genuinely Microsoft-owned endpoints (aka.ms, login.microsoftonline.com, aadcdn.msftauth.net, login.live.com, browser.events.data.microsoft.com) for the real authentication leg — producing a DNS/network fingerprint that blends malicious and legitimate Microsoft traffic. No CVE or software vulnerability is involved; this is pure abuse of a legitimate, MFA-adjacent authentication flow designed for input-constrained devices (smart TVs, CLIs) that was never intended to be surfaced to end users via a phishing lure. The technique class is not new — Microsoft's Storm-2372 (a suspected Russia-aligned actor) has run device-code phishing against government, NGO, defense, telecom, and energy-sector targets since August 2024, evolving by February 2025 to register attacker devices and mint Primary Refresh Tokens for deeper persistence — and a broader wave of OAuth device-code phishing (340+ M365 organizations across five countries) was reported by industry researchers in March 2026, with Microsoft publishing a follow-up on an AI-enabled variant in April 2026. The ReversingLabs campaign analyzed here is a distinct, unattributed cluster sharing the same technique class, landing-page kit style (ClickFix), and infrastructure-abuse patterns (workers.dev) as those broader waves, but the source does not attribute it to Storm-2372 or any other named actor.

## MITRE ATT&CK

- T1583.006 Web Services
- T1584.001 Domains
- T1566.001 Spearphishing Attachment
- T1566.002 Spearphishing Link
- T1204.001 Malicious Link
- T1098.005 Device Registration
- T1550.001 Application Access Token
- T1027 Obfuscated Files or Information
- T1102 Web Service
- T1036 Masquerading
- T1598 Phishing for Information
- T1621 Multi-Factor Authentication Request Generation
- T1528 Steal Application Access Token
- T1071.001 Web Protocols
- T1102.002 Bidirectional Communication
- T1531 Account Access Removal

## Sources

- [Device Code Phishing Campaign](https://www.reversinglabs.com/blog/device-code-phishing-campaign)
- [Storm-2372 conducts device code phishing campaign](https://www.microsoft.com/en-us/security/blog/2025/02/13/storm-2372-conducts-device-code-phishing-campaign/)
- [Device Code Phishing Hits 340+ Microsoft 365 Orgs Across Five Countries via OAuth Abuse](https://thehackernews.com/2026/03/device-code-phishing-hits-340-microsoft.html)
- [OAuth Device Code Phishing Hits 340+ Microsoft 365 Organizations](https://labs.cloudsecurityalliance.org/research/csa-research-note-oauth-device-code-phishing-m365-20260325-c/)
- [Access granted: phishing with device code authorization for account takeover](https://www.proofpoint.com/us/blog/threat-insight/access-granted-phishing-device-code-authorization-account-takeover)
- [Inside an AI-enabled device code phishing campaign](https://www.microsoft.com/en-us/security/blog/2026/04/06/ai-enabled-device-code-phishing-campaign-april-2026/)
- [OAuth's Device Code Flow Abused in Phishing Attacks](https://www.sophos.com/en-us/blog/oauths-device-code-flow-abused-in-phishing-attacks)
- [Steal Application Access Token, Technique T1528 - MITRE ATT&CK](https://attack.mitre.org/techniques/T1528/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1492