Microsoft 365 Users Targeted by Device Code Phishing Campaign Using OAuth 2.0 Flow

Active phishing campaign targeting Microsoft 365 users leverages the OAuth 2.0 Device Authorization (device code) flow to convince victims to authorize attacker-controlled devices, enabling account takeover without stealing passwords. The kit uses evasion (invisible Unicode characters, encoded/bit-shifted device-code artifacts), generates distinctive network beaconing behavior, and includes IOCs and YARA/network detection guidance for defenders.