TLDR Tech / InfoSec
When checking the URL isn't enough: a Device Code Phishing attack via a Microsoft website
Attackers deliver a password-protected PDF impersonating a law firm, chain it through legitimate open redirects on Microsoft and Cacoo.com domains, and route victims through CAPTCHA gates to a landing page that auto-copies a Microsoft OAuth device_code obtained via the legitimate devicecode endpoint. The victim pastes that code into Microsoft's genuine verification_uri, completes real MFA, and the attacker harvests the resulting access_token, refresh_token, and id_token to read mail, exfiltrate OneDrive files, and access Teams, with refresh_token enabling silent long-term persistence. The same technique has since been observed retargeting Brazilian users. Defenders should disable the Device Code Flow via Conditional Access if unused, monitor DeviceCodeSignIn events and enforce device compliance, alert on anomalous sign-in locations, and train users to never approve unsolicited device code prompts, even when the verification page is a genuine login.microsoftonline.com or microsoft.com/devicelogin URL.
Read the full story