Multiple threat groups have been ramping up attacks using a technique called device code phishing to trick users into granting access to their Microsoft 365 accounts, according to a report Thursday from Proofpoint.
Hackers affiliated with China and Russia have used the technique in recent months to launch attacks. A number of criminal groups have used the same method to target M365 users as well.
“This is a social engineering method that abuses a legitimate and trusted workflow for authorized access,” Sarah Sabotka, staff threat researcher at Proofpoint, told Cybersecurity Dive.
The technique involves sending a message with a URL that is embedded behind hyperlinked text or within a QR code. When a user engages the link it starts an attack sequence that uses a legitimate Microsoft device authorization process, according to Proofpoint.
After the process begins, a user is provided a device code. The code arrives on the landing page or in a secondary email, according to Proofpoint. The user is told to enter the device code as a one-time password. Once that is done, a token is validated and the hacker gains access to the M365 account.
Threat groups are using tools like SquarePhish2 or the Graphish phishing kit to launch attacks. The Graphish phishing kit allows hackers to create highly convincing phishing pages that leverage Azure app registrations and reverse proxy setups used in adversary-in-the-middle attacks.
The cybersecurity firm warned a criminal actor tracked under the name TA2723 has been offering a malicious tool for sale on hacking forums that can be used for such attacks. Researchers identified a campaign starting in early October in which the hacker deployed SquarePhish2 and a second campaign using Graphish.
A Russia-aligned group tracked under the name UNK_AcademicFlare is linked to a campaign that was first identified in September. The attacks use compromised emails from multiple governments and military organizations to target governments, think tanks, higher education and transportation sectors in the U.S. and Europe.
Microsoft did not comment on the research, but the company provided links to a prior research report in February that outlined a device code phishing campaign from a Russia-linked group tracked as Storm-2372. That group has been engaged in such attacks since August 2024, using a variety of techniques.
The company also released guidance from October about threats against Microsoft Teams.
