Researchers have identified a sophisticated phishing campaign that bypasses traditional URL-checking defenses by exploiting a legitimate Microsoft authentication feature. The attack leverages the Microsoft Identity Platform's Device Authorization Grant, a protocol designed for devices with limited input capabilities, such as smart TVs or IoT devices, to authenticate users.
The Device Authorization Grant flow allows a user to authorize an application on one device by using a separate device, like a smartphone or computer. The process typically involves the application generating a short code and a verification URL. The user then visits the URL on their second device, enters the code, and approves the application's access request. This flow is initiated by a request to `https://login.microsoftonline.com/{tenant}/oauth2/v2.0/devicecode`.
In the observed phishing attacks, attackers first trick victims into clicking a link that appears to lead to a legitimate Microsoft domain, specifically `https://microsoft.com/devicelogin`. However, the initial link is crafted with specific URL parameters that redirect the user to a phishing page. This page is designed to mimic a corporate legal portal and often employs CAPTCHAs to deter automated analysis.
Once past these initial defenses, victims are presented with a one-time code. The attackers, in parallel, have already used this code to query the Microsoft Identity Platform's device code endpoint and obtain the necessary authorization parameters. The phishing page instructs the victim to copy this code, which is conveniently placed on their clipboard, and then redirects them to the official Microsoft authentication page.
The victim then proceeds to authenticate directly on Microsoft's legitimate site, often completing multi-factor authentication. At this point, the attackers have successfully harvested critical tokens, including the access token, refresh token, and ID token. With these tokens, they can gain extensive access to the victim's account, including reading and sending emails, accessing files stored in OneDrive, and viewing Teams conversations.
One observed campaign ran from early April to mid-May 2026. The initial lure involved a password-protected PDF attachment. After the victim entered the password, a landing page displayed several documents, and clicking a link to view them initiated the attack chain.
Attackers are actively adapting this method. Recent variants have been detected targeting users in specific geographic regions, including Brazil. These newer campaigns may forgo PDF attachments, embedding the malicious link directly within the email body.
The core of the attack's success lies in its ability to direct victims to perform sensitive actions, like entering authentication codes and completing MFA, on trusted Microsoft domains. This circumvents the common security advice of scrutinizing unfamiliar URLs, as the final authentication steps occur on a seemingly legitimate platform.
The Device Authorization Grant flow, while convenient for its intended purpose, presents a potential attack vector when manipulated. The ability for attackers to intercept the authorization tokens after a user has successfully authenticated on a legitimate Microsoft service is the critical vulnerability exploited.
Microsoft's Device Authorization Grant specification is designed to facilitate authentication for devices lacking full browser or keyboard capabilities. The protocol involves a device requesting authorization, presenting a code and URL to the user, and then polling for confirmation after the user approves the request on a secondary device.
The attackers' ability to obtain refresh tokens is particularly concerning, as these tokens can be used to silently renew access tokens without further user interaction, potentially granting persistent access to compromised accounts.
