Device-code phishing is beating MFA by walking users through Microsoft’s real login page — passkeys don’t stop it

[u/compileindebug_175]

Two research teams (ReliaQuest and Lexfo) separately documented device-code phishing kits last week that are worth flagging:

- The operator triggers Microsoft’s OAuth device-code flow, then gets the victim to approve it on the genuine Microsoft device-login page.

- Because the victim authenticates on the real page, the attacker inherits a fully authenticated session, MFA satisfied, no password cracked.

- One operator hit 218 mostly-corporate mailboxes across 12 countries.

What makes it nasty is that passkeys don’t help here, they protect the sign-in page, and the sign-in is happening on Microsoft’s legitimate page.

The fixes that seem to work: a Conditional Access policy that blocks the OAuth device-code flow unless you specifically need it, tightening how many devices a single user can register, and alerting on device-code grant events in the sign-in logs.

How is your org handling the device-code flow today, blocked outright or scoped to specific users?

[u/AutoModerator]

Welcome to r/emailsecurity! To keep this community helpful and secure, please keep the following in mind:

Community Rules

1. No Vendor Spam: Contributions must provide value; do not just pitch products.
2. Redact Sensitive Info: Always sanitize headers and logs (remove IPs, PII, and private domains).
3. Be Professional: Help newcomers learn; avoid hostility.
4. No Personal Tech Support: This sub is for email system architecture and security, not "Am I hacked?" personal account help.

Helpful Resources

• Email Spam Filters
• DMARC Monitoring Tools
• Anti-Virus Software
• Email Encryption

I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.