# Device Code Authentication Phishing Abusing Microsoft Sign-In via Fake Mimecast Device Enrollment

> Cofense Phishing Defense Center describes phishing emails (e.g., fake bidding invitations) that lead victims to spoofed Syncfusion/Microsoft login pages and a fake Mimecast device enrollment page displaying an access code. The victim enters the code in a legitimate Microsoft authentication dialog, granting the attacker's application access to the account without the password and potentially bypassing MFA.

- **Published:** 2026-10-20T19:47:56Z
- **Last reviewed:** 2026-10-20T19:47:56Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-3981
- **ID:** TL-2026-3981
- **Severity:** HIGH
- **Category:** PHISHING
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 12 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Cofense's Phishing Defense Center (published 2026-10-20) documents a multi-stage device code phishing campaign. The lure is an ordinary-looking business email, such as a bidding invitation, with a subject line designed to capture interest. The link leads to a spoofed login page branded with Syncfusion and Microsoft that collects the victim's email address. The victim is then shown a spoofed Mimecast device enrollment page presented as an 'IT policy' step, which displays a temporary access code. The victim is told to enter that code into a Microsoft authentication window. Because that window is the legitimate Microsoft device code dialog, entering the code authorizes the originating (attacker-controlled) application to access the account without requiring the user's password, and may bypass MFA. Cofense notes the URL in the address bar does not match any of the three brands' registered domains. Targets are decision-makers, management-level personnel and key figures, though anyone is exposed.

The technique abuses the OAuth 2.0 Device Authorization Grant (RFC 8628). The attacker's application requests a device code and user code, the victim completes sign-in and MFA on genuine Microsoft infrastructure, and the attacker's polling loop receives access and refresh tokens. Microsoft's reporting on Storm-2372 (Russia-aligned, moderate confidence; reclassified in a July 2026 update as an initial-access sub-cluster of Midnight Blizzard) shows the same technique used for follow-on Graph API email harvesting and device registration through the Microsoft Authentication Broker client ID to obtain Primary Refresh Tokens. The Cloud Security Alliance reported a separate financially motivated wave, the EvilTokens PhaaS (launched 2026-02-16, 340+ Microsoft 365 organizations), with construction-bid lures similar to this campaign. No source ties the Cofense campaign to Storm-2372, TA2723 or EvilTokens, and the article names no actor, kit, domains or IPs. Attribution is therefore Unknown.

Remediation per Cofense: change the password, sign out and revoke active sessions, review account activity, remove unfamiliar authorized applications, re-verify security and MFA methods, and check for unauthorized forwarding rules or recovery address changes. Microsoft recommends blocking device code flow with a Conditional Access 'Authentication flows' policy wherever possible, and allowing it only for documented, secured use cases.

## MITRE ATT&CK

- T1566.002 Spearphishing Link
- T1078.004 Cloud Accounts
- T1204.001 Malicious Link
- T1684.001 Impersonation
- T1528 Steal Application Access Token
- T1111 Multi-Factor Authentication Interception
- T1550.001 Application Access Token
- T1098.005 Device Registration
- T1114.002 Remote Email Collection

## Sources

- [Beyond Passwords: How Attackers Abuse Device Code Authentication](https://cofense.com/blog/beyond-passwords-how-attackers-abuse-device-code-authentication)
- [Storm-2372 conducts device code phishing campaign](https://www.microsoft.com/en-us/security/blog/2025/02/13/storm-2372-conducts-device-code-phishing-campaign/)
- [Block authentication flows with Conditional Access policy](https://learn.microsoft.com/en-us/entra/identity/conditional-access/policy-block-authentication-flows)
- [CSA Research Note: OAuth Device Code Phishing Hits 340+ Microsoft 365 Organizations](https://labs.cloudsecurityalliance.org/research/csa-research-note-oauth-device-code-phishing-m365-20260325-c/)
- [Threat researchers spot 'device code' phishing attacks targeting Microsoft accounts](https://cyberscoop.com/?p=83517)
- [Phishing campaign targets Microsoft device code authentication flows](https://www.cybersecuritydive.com/news/phishing-campaign-targets-microsoft-device-code-authentication-flows/740201/)
- [Storm-2372: Russia-Linked Hackers Exploit Microsoft 365 Device Code Phishing](https://www.rescana.com/post/storm-2372-russia-linked-hackers-exploit-microsoft-365-device-code-phishing-for-account-takeovers)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-3981