Device-code phishing: approving a login you never started
In February 2025, Microsoft Threat Intelligence Center documented an active campaign by the actor it tracks as Storm-2372, which harvested sign-in sessions from organisations in Europe, North America, Africa and the Middle East. The technique behind it, device-code phishing, is notable for what it avoids: there is no fake login page to spot, no password to steal and no malware to detect. The victim never types a secret at all. A code supplied by the attacker gets entered on Microsoft's genuine sign-in page, the victim approves the prompt on their own device, and the attacker walks away with a working session.
A legitimate feature, turned around
Device code flow is a real OAuth 2.0 feature, not a forgery. It exists for hardware with no usable keyboard or browser: printers, televisions, conference-room screens, set-top boxes. The device displays a short code, the user opens the login portal on a phone or laptop, enters the code, signs in and approves. The device then receives its tokens. Storm-2372 turned this sequence inside out. According to Microsoft, the group ran the campaign from August 2024, opening chats in Microsoft Teams that posed as senior staff or officials, then moving the conversation to Signal or WhatsApp under the pretext of sharing documents. Meeting invitations sent by email carried the same lure, styled to look like ordinary Teams traffic. BleepingComputer's reporting on the same campaign described victims being asked to authenticate a device in order to receive an important document, following a link to Microsoft's real device login page, entering the code they had been sent and approving the sign-in, complete with their usual multi-factor step. Targets documented by Microsoft included government bodies, IT service providers, defence, telecommunications, healthcare, higher education and energy companies.Why this defeats MFA entirely
The order of operations is what makes it work. The attacker initiates a legitimate device code request first and only then involves the victim. When the victim enters the code and approves, every check on the login page passes honestly: the page is real, the code is valid, and the person interacting with it completes a genuine sign-in, including whatever multi-factor authentication applies. The tokens Microsoft issues, including long-lived refresh tokens, go to whoever started the request, which is the attacker. From the directory's point of view, a user simply signed in successfully. There is nothing for mail filters or web proxies to flag, because the infrastructure involved is entirely legitimate. Microsoft's write-up records what happened next in compromised tenants: attackers searched mailboxes with Graph API queries for terms like credentials, passwords and admin, exfiltrated correspondence, and used trusted internal accounts to phish colleagues, so one approval could cascade through an organisation. In an update published a day after the original post, Microsoft also documented a shift towards requests made through the Microsoft Authentication Broker client, letting the actor register attacker-controlled devices and request primary refresh tokens. Proofpoint, which followed the technique as it spread through phishing kits during 2026, noted a further refinement: codes generated on demand the moment a victim clicks a link, sidestepping the fifteen-minute expiry of a pre-generated code.The usual advice, look closely at the login page before you type anything, does not help here. Proofpoint's analysis of later campaigns points out that checking the URL fails because the portal is genuinely Microsoft's; what is being abused is the victim's approval, not the address bar.
Red flags worth teaching
The tells are consistent across campaigns, and none of them require technical skill to notice.- a sign-in you did not start: a device code only exists because someone requested one
- urgency and pressure to act before a code expires or a meeting begins
- an email, chat or message asking you to approve or authenticate something with a code you never requested
- contact that hops platforms, such as a Teams chat that moves to Signal or WhatsApp
- a document or meeting invite that only unlocks once you verify a code