Microsoft 365 accounts targeted in wave of OAuth phishing attacks

Proofpoint reports a surge in OAuth device code phishing targeting Microsoft 365 accounts where attackers trick users into entering device codes on Microsoft's legitimate device login page to authorize attacker-controlled applications. Campaigns use phishing kits (SquarePhish v1/v2 and Graphish) and lures like document-sharing or token reauthorization; actors include financially motivated groups (TA2723) and a suspected Russia-aligned actor (UNK_AcademicFlare). Proofpoint recommends mitigations such as Microsoft Entra Conditional Access and sign-in origin policies to reduce successful account takeovers.