Device Code Phishing: Where User Training & MFA Both Fail
The device code phishing process occurs on legitimate Microsoft infrastructure. As a result, traditional security training that teaches users to check URLs for red flags often fails. Once the user enters the code and completes their MFA challenge, the attacker intercepts the resulting access and refresh tokens giving them long term access to the user's email, teams and other Azure services.
The device code flow was originally designed for "input-constrained devices", such as smart TVs, gaming consoles, or IoT printers, that lack a traditional keyboard or web browser. While it is a niche authentication method, threat actors have increasingly hijacked it to conduct high-powered
