The Microsoft 365 Account Takeover That Leaves No Trace

Proofpoint tracks active campaigns since September 2025 that abuse Microsoft's OAuth 2.0 device authorization grant flow. MFA is bypassed without exploits, malware, or stolen credentials.

Proofpoint Threat Research tracks threat clusters that, since September 2025, have compromised Microsoft 365 accounts without malware, zero-days, or stolen credentials. The mechanism abuses the OAuth 2.0 device authorization grant flow: a legitimate protocol that, if left enabled by default in Microsoft Entra ID, allows an attacker to receive access tokens after the victim completes authentication and MFA on Microsoft's genuine servers. The identity platform logs a normal login.

The escalation involves state-linked actors tied to Russia, tracked as UNK_AcademicFlare, and criminal operators such as TA2723. Targeted sectors include government, think tanks, higher education, transportation, and energy in the United States and Europe. What distinguishes this campaign from typical credential-theft reporting is not technical sophistication but operational cleanliness: the attack unfolds entirely in the identity layer, off the victim's machine, rendering it invisible to endpoint tooling.

Key Takeaways

Proofpoint detected a significant increase in device code phishing campaigns since September 2025, involving Russian state actors (UNK_AcademicFlare) and criminal operators (TA2723).
The mechanism abuses Microsoft's legitimate OAuth 2.0 device authorization grant flow: the victim enters a code on the authentic microsoft.com/devicelogin, completing MFA on the attacker's behalf.
From Microsoft Entra ID's perspective, the authentication appears routine, with no anomalous fingerprints; no credentials are stolen and no login page is spoofed.
Phishing kits like Graphish and red-team frameworks like SquarePhish2 have lowered the barrier to entry, democratizing a technique previously reserved for advanced operators.

How the Flow Nobody Monitors Works

The device authorization grant, defined in RFC 8628, is designed for devices without direct input interfaces: smart TVs, printers, IoT tools. The device requests a code, the user enters it on a separate terminal, and Microsoft issues the token to the originating device. In this campaign the attacker flips the roles: they initiate the device-code request, receive the user_code, and present it to the victim via social engineering.

According to Trend Micro's analysis, the attacker initiates the legitimate request, obtains a real code, and tricks the victim into approving it. Once the victim enters the code on microsoft.com/devicelogin and completes multi-factor authentication, Microsoft issues access and refresh tokens to the attacker's server. Trend Micro documents a concrete case: the attacker poses as a law firm partner, uses conversation chaining, a link hosted on Google Sites with an open redirect, and a fake human-check prompt to push the user toward approving the code.

The technical consequence is that the attacker obtains long-lived tokens, with which they register legitimate devices in the victim's environment, create hidden mailbox rules, and launch subsequent phishing campaigns to hundreds of recipients. All of this occurs with authentic credentials and valid OAuth flows.

The Kit That Makes the Attack Scalable

ReversingLabs analyzed an active phishing kit that exploits "approval for estimate" lures: a JPG image with a hidden HTML attachment, in ClickFix style. The technique for opening the authentic Microsoft flow begins with a window.open() call to the URL hxxps[://]aka[.]ms/devicelogin, Microsoft's legitimate URL. The kit incorporates evasion techniques based on invisible Unicode characters: Zero Width Space, Word Joiner, and Zero Width Non-Joiner interspersed in keywords such as "Agreement," "Verify," "Microsoft," and "account" to evade text-pattern detection systems.

ReversingLabs' forensic analysis identifies a precise beaconing pattern: the device code is transmitted to the kit host via POST on a four-second cycle, in URL form-encoded format with the code as the value of the 'dc' key. The traffic contains the bit-shifted string 'EvoStsArtifacts,' an artifact stemming from the Microsoft Entra ID Security Token Service. ReversingLabs provides YARA signatures for detection of the landing pages and associated network traffic.

Why This Matters

The dossier does not specify detailed corrective measures released by Microsoft to restrict the device authorization grant flow at the tenant level. The brief does not document specific Microsoft Entra ID versions affected, nor a specific CVE: the technique remains classifiable as abuse of legitimate functionality, not a software vulnerability. Nor does a precise quantification of the "significant increase" reported by Proofpoint emerge in terms of percentages or absolute volumes of compromised accounts.

The analytical value of the case lies in the configuration paradox. While the infostealer ecosystem evolves toward complex affiliate models, with log-sharing infrastructures and customer management panels, device code phishing is technically simpler and cleaner. It requires no malware installation, leaves no artifacts on endpoints, and needs neither password theft nor MFA bypass via real-time phishing proxies. It requires only that a permissive default setting — the device authorization grant enabled for all users — was never restricted.

Trend Micro underscores the relevant consequence for defense: "The attack occurs in the identity layer... Everything happened in the cloud, off the victim's machine, which is part of why this style of attack is hard to detect with endpoint tooling alone." Traditional endpoint protection tools do not observe legitimate authentications on authentic cloud infrastructure.

"Attackers abuse a legitimate Microsoft OAuth 2.0 authentication flow to capture valid access tokens, bypassing MFA entirely because the user willingly completes the login themselves."

How Different From the Infostealer Market

The comparison with the evolution of the infostealer market, documented by Trend Micro in contextual research, illuminates the specificity of this threat. Infostealers have structured into affiliate ecosystems with hierarchies of developers, panel operators, log buyers, and crypter providers. Device code phishing inverts the logic: fewer moving parts, less detection surface, higher reliability. There is no executable to sign, no binary to obfuscate, no suspicious C2 communication to monitor.

The source does not specify whether the campaign analyzed by ReversingLabs in June 2026 is directly linked to the same Proofpoint actors or represents an independent operation. The tactical kit — the aka.ms URL, the four-second beacon, Unicode evasion — shows technical convergence but no evidence of infrastructural overlap or common attribution.

Frequently Asked Questions

In what sense is MFA "bypassed" if the victim completes it?

Multi-factor authentication is not technically bypassed: the victim performs it authentically on Microsoft servers on their own initiative, believing they are authorizing their own device. The attacker does not intercept the second factor or replay it; they induce the victim to complete the authentication circle for them.

Why doesn't the Microsoft platform detect the anomaly?

For Microsoft Entra ID, the authentication is formally correct: valid user, valid device code, MFA completed, token issued to the server that initiated the flow. The dossier does not document automatic controls that verify consistency between the device originating the request and the device of the user completing authentication.

Is the ReversingLabs kit the same campaign as Proofpoint's?

No infrastructural overlaps emerge linking the kit analyzed by ReversingLabs to the UNK_AcademicFlare or TA2723 actors in Proofpoint's research. The Unicode evasion techniques and the POST beacon pattern every four seconds are documented as independent indicators.

Information is based on the cited advisory and current as of publication.

Information is based on the cited source and current as of publication.

Sources

Sources and references