Hackers Exploit OAuth Device Flow to Steal Microsoft 365 Tokens

This report details a rapid increase in device code phishing—where attackers trick users into authorizing malicious applications via Microsoft’s OAuth device flow—driven by criminal toolkits (EvilTokens, ODx, Kali365) and phishing-as-a-service offerings; it highlights TA4903’s campaigns, dynamic on-demand code generation, numerous phishing domains/landing pages as IOCs, the potential for enterprise account takeovers and follow-on ransomware or fraud, and recommends mitigations such as restricting device code flows via conditional access.