🎯 Threat Intelligence
Device code flow phishing continues to surface as an initial access technique in M365 and BEC incident response engagements handled by TrustedSec. The technique bypasses both user suspicion and several Conditional Access patterns organizations depend on.
Legitimate Device Code Flow
The OAuth 2.0 device authorization grant (RFC 8628) exists for devices that cannot host a browser, such as smart TVs, CLI tools, IoT hardware, and printers. Microsoft implements it in Entra ID for Azure CLI, the kubectl Entra plugin, and device enrollment flows.
The flow runs in six steps:
- The client requests a device code from Entra ID, specifying resource and scopes
- Entra returns a device_code, a human-readable user_code, the verification URL at microsoft.com/devicelogin, and a ~15 minute TTL
- The client displays the code and URL to the user
- The user opens the URL on a second device, enters the code, signs in, and consents
- The client polls the token endpoint with the device_code
- Entra issues an access_token and refresh_token to the polling client
The Attack
The critical gap: nothing in the protocol binds the party who initiates the flow to the party who completes authentication. An attacker initiates the flow, obtains a device code, then social-engineers a victim into entering that code on the real microsoft.com/devicelogin. The victim signs in, approves legitimate MFA prompts, and consents. Tokens are issued to the attacker's polling session.
The lure typically mimics a legitimate login request, often claiming a shared document requires authentication. The link points to the actual Microsoft domain, not a lookalike. Every element the victim interacts with is genuine Microsoft infrastructure.
Why It Works
MFA is not technically bypassed. The victim completes it legitimately, and the policy is satisfied. Conditional Access policies see authentication originating from a legitimate Microsoft endpoint, not attacker-controlled redirect infrastructure. The only forensic artifact is an OAuth token issued to a session the attacker controls. The 15-minute device code window provides ample time for social engineering delivery.
Detection
Monitor Entra ID sign-in logs for the authentication method "Device Code Flow." Correlate with user behavior baselines to identify unexpected usage. Tokens granted via this method from unusual locations or for atypical applications warrant investigation. Consider restricting device code flow entirely in environments that do not require it.
The source describes the mechanism from lab-tenant reproductions. No specific IOCs from live incidents are provided.
🔹 devicecodephishing #M365 #OAuth #ConditionalAccess #ThreatIntelligence
🔗 Source: https://trustedsec.com/blog/the-new-hotness-in-phishing-device-code-attacks-in-m365?utm_content=382987031&utm_medium=social&utm_source=twitter&hss_channel=tw-403811306
