Device Code Phishing: A New Threat to Microsoft 365 Security in 2026
In early 2026, a sophisticated phishing campaign exploited Microsoft's OAuth 2.0 Device Authorization Grant flow to compromise Microsoft 365 accounts across over 340 organizations in the U.S., Canada, Australia, New Zealand, and Germany. Attackers tricked users into entering device codes on legitimate Microsoft authentication pages, granting unauthorized access without stealing passwords or bypassing multi-factor authentication. This method allowed threat actors to maintain persistent access to compromised accounts, leading to data breaches and potential financial losses. ([cryptika.com](https://www.cryptika.com/attackers-hijack-microsoft-365-accounts-through-oauth-device-code-abuse-without-stealing-passwords/?utm_source=openai)) The incident underscores a significant shift in phishing tactics, with attackers increasingly abusing legitimate authentication workflows to evade detection. Organizations must enhance their security measures to address these evolving threats, including educating users about such sophisticated phishing techniques and implementing stricter controls over device code authentication. ([securitybrief.com.au](https://securitybrief.com.au/story/proofpoint-warns-of-surge-in-microsoft-device-code-phishing?utm_source=openai))
Kill Chain
