Microsoft 365 device-code phishing: a different path to account access

Original reporting date: 2025-12-19 · Source: BleepingComputer

What happened

Phishing campaigns trick users into entering device codes on a legitimate Microsoft page, authorizing an attacker-controlled sign-in flow.

Why it matters to businesses

MFA and awareness need to be complemented with OAuth governance, session monitoring and authentication-flow controls.

Practical IT checklist

• Audit device-code sign-ins in Entra and restrict unnecessary use.
• Review OAuth consent policies and application permissions.
• Revoke suspicious tokens and investigate risky sign-ins.

Source and full reporting: BleepingComputer ↗

Original VALUE360 editorial summary and practical commentary; not a reproduction of the source article.