Since September 2025, multiple threat clusters, both financially motivated and state-aligned, have scaled a new wave of phishing that doesn’t steal passwords and doesn’t break MFA in the traditional sense. Instead, adversaries weaponize the legitimate OAuth 2.0 device code authorization flow by convincing users to enter a “verification code” on Microsoft’s real microsoft.com/device login page. That one user action grants attacker-controlled applications for long-lived OAuth tokens to the victim’s Microsoft 365 account. Because all this occurs on a genuine Microsoft domain, the campaign evades standard phishing detections and user suspicion.
Attack kits like Square Phish and Graphish automate the attack sequence, often embedding QR codes, “salary bonus” document lures, or token re-authorization prompts. The victim is funneled to the legitimate device login workflow; once they enter the provided code, Microsoft issues an OAuth access token to the attacker app, not the user’s device. With a refresh token, attackers maintain persistent access to emails, files, and collaboration tools without ever intercepting passwords or real-time MFA codes.
Microsoft recommends Conditional Access to either block device code flow outright or limit it to tightly controlled user groups, devices, or network origins; tighten app consent policies and monitor OAuth registrations.
The OAuth device-code wave is live and scaling. ShieldForce deploys policy guardrails, user education, live detection, and recovery guarantees that turn a stealthy identity breach into a short, contained incident.