# Device Code Phishing: Turning a Convenience Feature Into an MFA Bypass (Microsoft 365/Entra ID)

> Trend Micro documents device-code phishing against Microsoft 365/Entra ID users: the victim is lured to enter an attacker-initiated device code on the genuine Microsoft sign-in page and completes MFA, so Microsoft issues tokens to the attacker. The attacker then registers devices and creates mailbox rules for persistent access. No password is stolen and MFA is satisfied.

- **Published:** 2026-11-06T16:08:36Z
- **Last reviewed:** 2026-11-06T16:08:36Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-5428
- **Card image:** https://intel.threadlinqs.com/og/threat/TL-2026-5428.png
- **ID:** TL-2026-5428
- **Severity:** HIGH
- **Category:** PHISHING
- **Status:** ACTIVE
- **Detections:** 9 (1 shown free below) · **IOCs:** 19 (3 shown free below)

## Description

The campaign abuses the OAuth 2.0 device authorization grant (device code flow) in Microsoft Entra ID. The attacker initiates a device-code flow, obtains a user code, and lures the victim into entering that code on the legitimate Microsoft device-login page. Because the victim authenticates (including MFA) on a genuine Microsoft page, Microsoft issues access and refresh tokens to the attacker's polling client. No password is captured and MFA is satisfied, so MFA-based controls provide no protection.

As documented by Trend Micro (2026-07-22), the chain starts with social-engineering contact from impersonation sender domains (a law-firm style lure, e.g. rlcounsel.com and cholaw-kr.co), followed by a phishing link that passes through compromised open redirectors (eusei.com, cineuropa.org, zrdesignlabo.com) to a fake document portal hosted on Google Sites, and then to phishing endpoints (hlpadditives.com and flosli.com subdomains, and a Cloudflare workers.dev page) that present the device-code prompt. Trend detects the credential-harvesting page as HTML.Phish.Microsoft.

Within hours of the victim approving the code, the attacker signed in from abroad, registered devices in Entra ID using the device-code token (token misuse against the Device Registration Service, visible as OriginalTransferMethod deviceCodeFlow), created inbox rules (including rules moving mail to hidden folders), and sent phishing to hundreds of recipients from the compromised mailbox. This mirrors the Authentication Broker client / device registration technique Microsoft described for Storm-2372 in February 2025, but Trend's report names no actor, malware, or hashes and no attribution is made here.

Defensive focus: device-code sign-ins should be rare and can be blocked with Conditional Access; monitor Authentication Broker activity from unfamiliar locations, spikes in device registration, and mailbox rule changes. Require phishing-resistant MFA, managed/compliant devices, named locations, Continuous Access Evaluation, and token protection, and restrict device registration privileges.

## MITRE ATT&CK

- T1583 Acquire Infrastructure
- T1584 Compromise Infrastructure
- T1566.002 Spearphishing Link
- T1621 Multi-Factor Authentication Request Generation
- T1528 Steal Application Access Token
- T1550.001 Application Access Token
- T1550.001 Application Access Token
- T1098.005 Device Registration
- T1556.006 Multi-Factor Authentication
- T1114 Email Collection
- T1564.008 Email Hiding Rules
- T1684.001 Impersonation

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**Entra ID Successful Device Code Flow Sign-In (Device Code Phishing)** (`TL-2026-5428-SPL-001`)

TL-2026-5428: fires on a successful Microsoft Entra ID sign-in using the OAuth device authorization grant (authenticationProtocol=deviceCode). In the device-code phishing campaign documented by Trend Micro the victim approves an attacker-initiated code on the genuine Microsoft page and MFA is satisfied, so the attacker's polling client receives access and refresh tokens (T1528, T1550.001, T1621). Device-code sign-ins are rare in most tenants, so any success is worth triage.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1528, T1550.001, T1621
- **Data sources:** azure:monitor:aad (Entra sign-in logs), SigninLogs, AADNonInteractiveUserSignInLogs, azure_signinlogs
- **Severity:** high
- **Confidence:** high

### Splunk SPL

```spl
index=azure sourcetype="azure:monitor:aad" (category="SignInLogs" OR category="NonInteractiveUserSignInLogs") properties.authenticationProtocol=deviceCode properties.status.errorCode=0
| eval user='properties.userPrincipalName', src_ip='properties.ipAddress', app='properties.appDisplayName', country='properties.location'
| stats count min(_time) as first_seen max(_time) as last_seen values(app) as apps values(src_ip) as src_ips values(country) as countries by user
| convert ctime(first_seen) ctime(last_seen)
```

### Microsoft KQL

```kql
union isfuzzy=true SigninLogs, AADNonInteractiveUserSignInLogs
| where TimeGenerated > ago(24h)
| where ResultType == 0
| where AuthenticationProtocol =~ "deviceCode" or OriginalTransferMethod =~ "deviceCodeFlow"
| summarize Events = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated), Apps = make_set(AppDisplayName), IPs = make_set(IPAddress) by UserPrincipalName
```

### Sigma

```yaml
title: Entra ID Successful Device Code Flow Sign-In
id: 5b0e6a1c-3d52-4c8e-9a41-7f2d1e8b5c01
status: experimental
description: Detects successful Microsoft Entra ID sign-ins using the OAuth device code flow, abused in device-code phishing to obtain tokens after the victim completes MFA on the genuine Microsoft page.
references:
    - https://www.trendmicro.com/en_us/research/26/g/device-code-phishing.html
    - https://www.microsoft.com/en-us/security/blog/2025/02/13/storm-2372-conducts-device-code-phishing-campaign/
author: Threadlinqs Team
date: 2026/11/06
tags:
    - attack.credential-access
    - attack.t1528
    - attack.t1621
    - attack.lateral-movement
    - attack.t1550.001
logsource:
    product: azure
    service: signinlogs
detection:
    selection:
        AuthenticationProtocol: deviceCode
        ResultType: 0
    condition: selection
falsepositives:
    - Legitimate device-code sign-ins from Azure CLI, PowerShell or input-constrained devices (TVs, IoT, Teams Rooms)
    - Developers using az login --use-device-code
level: high

```

**Known false positives:**

- Azure CLI / PowerShell device-code logins by administrators and developers
- Teams Rooms, kiosks and IoT devices that legitimately use device code

**Tuning notes:** Exclude known service accounts, device UPNs and corporate egress IPs via a lookup. Confirm the authenticationProtocol field name in your ingest (diagnostic-settings vs Graph export). Enforce a Conditional Access authentication-flows block for device code and treat residual hits as high priority.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- Device-Code Sign-In via Authentication Broker or From New Country (locked: unlock with TL Creds)
- Device Registration Within 6 Hours of Device-Code Sign-In (locked: unlock with TL Creds)
- Device-Code Phishing Lure: Impersonation Sender Domains and Phishing Chain URLs (locked: unlock with TL Creds)
- Device-Code Phishing Link Chain via Compromised Redirectors and Google Sites (locked: unlock with TL Creds)
- Suspicious Inbox Rule Moving or Deleting Mail to Hidden Folders After Account Takeover (locked: unlock with TL Creds)
- DNS Resolution of Device-Code Phishing Endpoints (hlpadditives.com, flosli.com, [indicator]) (locked: unlock with TL Creds)
- Device-Code Token Used Against Device Registration Service (deviceCodeFlow) (locked: unlock with TL Creds)
- Entra ID Sign-In From Device-Code Phishing Attacker IPs (Trend Micro IOCs) (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (3 of 19)

Defanged, TLP:CLEAR.

- IP address: `104.219.238[.]253`
- Domain: `rlcounsel[.]com`
- IP address: `43.165.1[.]42`

Full set of 19 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [Device Code Phishing: Turning a Convenience Feature Into an MFA Bypass](https://www.trendmicro.com/en_us/research/26/g/device-code-phishing.html)
- [Storm-2372 conducts device code phishing campaign](https://www.microsoft.com/en-us/security/blog/2025/02/13/storm-2372-conducts-device-code-phishing-campaign/)
- [Phishing campaign targets Microsoft device code authentication flows (Cybersecurity Dive)](https://www.cybersecuritydive.com/news/phishing-campaign-targets-microsoft-device-code-authentication-flows/740201/)
- [Microsoft identity platform and the OAuth 2.0 device authorization grant flow](https://learn.microsoft.com/en-us/entra/identity-platform/v2-oauth2-device-code)
- [Conditional Access: Authentication flows condition](https://learn.microsoft.com/en-us/entra/identity/conditional-access/concept-authentication-flows)
- [MITRE ATT&CK T1621 Multi-Factor Authentication Request Generation](https://attack.mitre.org/techniques/T1621/)
- [MITRE ATT&CK T1528 Steal Application Access Token](https://attack.mitre.org/techniques/T1528/)
- [MITRE ATT&CK T1098.005 Account Manipulation: Device Registration](https://attack.mitre.org/techniques/T1098/005/)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-5428