Proofpoint Threat Research has tracked threat clusters that, since September 2025, have intensified abuse of the OAuth 2.0 device authorization grant flow to compromise Microsoft 365 accounts without stealing passwords and by having victims complete multi-factor authentication on official platform domains. The attack exploits no vulnerability; it exploits a configuration most organizations do not know they need to control. Trend Micro, Push Security, and ReversingLabs have confirmed the mechanism and escalation, with the emergence of PhaaS kits lowering the barrier to entry even for non-specialized operators.
- Proofpoint identified the UNK_AcademicFlare cluster (attributed to Russia) and TA2723 as active actors in device code phishing against governments, think tanks, universities, transportation, and energy sectors in the United States and Europe.
- The attack uses the legitimate OAuth 2.0 device authorization grant flow: the victim enters a code on
microsoft.com/devicelogin, completes MFA on an authentic domain, and releases tokens to the attacker-controlled application. - Push Security detected a 37.5-fold increase in device code phishing pages in 2026, with over 14 distinct kits in circulation; EvilTokens is the first documented criminal PhaaS kit for this technique, launched in February 2026.
- Trend Micro documented the post-exploitation escalation: registration of rogue devices via Microsoft Authentication Broker and acquisition of long-lived refresh tokens.
How the Authentication Engineering Works
The attack relies on the protocol defined in RFC 8628. The operator initiates a device code request to Microsoft, obtains a user code and a verification URL, then lures the victim into entering that code on microsoft.com/devicelogin or the corresponding aka.ms short links. ReversingLabs confirmed the use of the legitimate URL aka.ms/devicelogin, hosted on Akamai infrastructure, in the landing pages analyzed.
The victim sees Microsoft's official login page, enters their credentials, and completes multi-factor authentication exactly as they would in any other context. The system issues access and refresh tokens to the application registered by the attacker. Proofpoint emphasizes that "no credentials are stolen, no login page is faked, and nothing is technically broken": the victim's identity appears normal to the platform.
Trend Micro analyzed cases where the attacker, after initial access, leverages the Microsoft Authentication Broker to register a controlled device and obtain long-lived refresh tokens, establishing persistence that survives the victim's password change.
The Escalation Since September 2025 and Criminal Commoditization
Proofpoint observed a significant increase in these campaigns starting in September 2025. The mechanism is not new: Microsoft had documented the technique's use by the Storm-2372 cluster as early as August 2024, with escalation to the Primary Refresh Token in February 2025. What has changed is the democratization of the attack.
Push Security detected a 37.5-fold increase in device code phishing pages in 2026, compared to an already 15-fold increase detected in March. The same source identified over 14 distinct kits in circulation and documented EvilTokens as the first dedicated criminal PhaaS kit for device code phishing, launched in February 2026 and already used in large-scale campaigns.
The Hacker News, citing Huntress data, reported that the EvilTokens cluster alone hit over 340 Microsoft 365 organizations across five countries, with 84% of observed events attributed to three IP addresses on Railway.com infrastructure. In parallel, ZeroBEC described the DEBULL tooling as reusable broker infrastructure that encapsulates Storm-2372 tradecraft, confirming the transition from techniques developed by advanced actors to off-the-shelf products for cybercrime.
The "Configuration Hygiene" Blind Spot
Proofpoint's suggested angle is that organizations verify MFA activation as a security metric but do not check which authentication flows remain enabled. The device authorization grant is legitimate for IoT scenarios and devices with limited input; for most organizations that do not use it, it represents an invisible attack surface.
This creates a paradox for security teams: authentication appears correct in logs, MFA has been satisfied, the domain is authentic, yet access is compromised. Trend Micro highlighted how traditional controls based on detecting fake phishing pages or analyzing stolen credentials do not intercept this attack chain.
"Device code phishing succeeds not because security controls fail, but because they were never configured to stop it" — Reach.Security reporting Proofpoint's conclusions
What to Do Now
- Verify in Microsoft Entra ID Conditional Access whether the OAuth device authorization grant flow is enabled: blocking it where unnecessary is the most effective mitigation indicated by Proofpoint.
- Check registered applications in the tenant to detect suspicious registrations that could serve as destinations for device code tokens.
- Monitor authentication logs for sessions originating from device code flow with subsequent escalation to token requests for the device registration service, a pattern documented by Trend Micro.
- Assess the availability of detection rules in XDR/SIEM systems: Trend Micro has published specific detection queries for this mechanism.
Why Commoditization Changes the Risk Threshold
The transition from a manual technique of advanced actors to a PhaaS product available at scale changes the geometry of the threat. Specific expertise in Azure AD or the OAuth protocol is no longer required: infrastructure is provided as a service, with pre-packaged landing pages and victim management panels. Push Security and Huntress agree that 2026 marks the shift from experimental phase to mainstream adoption of the technique.
The open question concerns cluster overlap: Proofpoint tracks UNK_AcademicFlare and TA2723; Microsoft and ZeroBEC/BEC discuss Storm-2372 and DEBULL; Huntress and Push Security analyze EvilTokens. Whether these are distinct actors sharing tradecraft or segments of the same supply chain is uncertain at present. What sources convergently document is that the mechanism works, standard defenses do not catch it, and the barrier to entry continues to drop.
Frequently Asked Questions
Why doesn't MFA block this attack?
Because the victim performs real and complete authentication, MFA included, on Microsoft's legitimate domain. MFA verifies the user's identity, not the intent to authorize a specific application.
Is this a Microsoft vulnerability to be fixed with a patch?
No. The device authorization grant flow is a standardized feature in RFC 8628 and is correctly implemented. The abuse is configurational, not implementational: the organization has not disabled a flow it does not use.
What is the risk if the device code expires in 15 minutes?
The 15 minutes are the validity window for the user code to be entered, documented by Microsoft for Storm-2372. The attacker coordinates the victim in real time; once the access token and refresh token are obtained, persistence can last months through the registration of rogue devices.
Sources
- https://www.reach.security/blog/what-device-code-phishing-reveals-about-security-configuration-gaps
- https://www.trendmicro.com/en_us/research/26/g/device-code-phishing.html
- https://thehackernews.com/2026/07/debull-tooling-abuses-microsoft-device.html
- https://www.reversinglabs.com/blog/device-code-phishing-campaign
- https://pushsecurity.com/blog/device-code-phishing/
- https://www.trendmicro.com/vinfo/us/security/news/cybercrime-and-digital-threats/from-stealers-to-systems-the-new-model-of-credential-theft
- https://thehackernews.com/2026/03/device-code-phishing-hits-340-microsoft.html
- https://thehackernews.com/2025/02/microsoft-russian-linked-hackers-using.html
Information verified against cited sources and current as of publication.