Beware of Device Code Phishing

The report explains device code phishing — an OAuth-based social engineering technique in which attackers induce victims to enter a device code on a legitimate authentication page, enabling attackers to harvest access and refresh tokens that bypass MFA and conditional access. It cites real-world use by APT29 and the Storm-2372 campaign against Microsoft Entra ID and collaboration platforms, outlines why the technique is effective (no malicious links/attachments, leverages user habits), and provides mitigations including user training, conditional access enforcement, OAuth activity monitoring, least-privilege OAuth scopes, and token revocation practices.