Hackers Hijack Microsoft 365 Accounts via Legitimate Device Code Flows

Both fraudulent actors and state-sponsored syndicates have commenced the large-scale deployment of a novel stratagem to usurp Microsoft 365 credentials. Eschewing traditional password theft, these adversaries coerce victims into voluntarily granting account access via Microsoft’s legitimate authorization protocols. The offensive utilizes a repertoire of hyperlinks, QR codes, and fraudulent notifications regarding sensitive documents, financial incentives, or security verifications.

Analysts at Proofpoint report a precipitous surge in such campaigns since September 2025. Previously, these “device code” incursions were rare and predominantly reserved for bespoke operations; however, the methodology is now utilized by multiple collectives, including the financially motivated TA2723 and suspected Chinese cyber-espionage units.

The assault exploits the OAuth Device Code Flow, a mechanism engineered by Microsoft to facilitate authentication on devices with limited input capabilities, such as televisions or gaming consoles. In a legitimate scenario, a user receives a specific code and inputs it into an official Microsoft portal to authorize a session. Upon confirmation, the service generates an access token.

Adversaries have repurposed this procedure for malevolent ends. A victim receives correspondence containing a link, a call-to-action button, or a QR code, often masquerading as a notification for a corporate bonus, employee benefits, or a re-authorization mandate. Upon interaction, the user is directed to a fraudulent site that provides a code and instructions to enter it on the authentic Microsoft portal—ultimately granting the assailant dominion over the account.

One particularly salient campaign utilized the subject line “Salary Bonus + Employer Benefits Reports 25,” promising recipients a document detailing financial incentives. The embedded link directed users to a malicious site styled as their own corporate portal. After entering their email address, the visitor was presented with a “multi-factor authentication code” and redirected to microsoft.com/devicelogin. Submitting the code effectively surrendered control of the Microsoft 365 account to the fraudsters.

The TA2723 group executed a parallel scheme in October 2025, targeting individuals with notifications regarding an allegedly updated payroll statement. Interacting with the document trigger redirected the user to a code-generation page, and subsequently to the official Microsoft service to finalize the breach.

To orchestrate these offensives, adversaries leverage sophisticated toolkits such as SquarePhish2 and Graphish. The former automates phishing campaigns involving QR codes and Microsoft device authorization flows, while the latter facilitates the creation of deceptive login pages and session interception via reverse proxies.

Proofpoint expressed profound concern regarding the burgeoning activity of state-aligned groups. Since January 2025, specialists have documented numerous espionage campaigns utilizing this device-code phishing technique. One such entity, identified as UNK_AcademicFlare, has utilized compromised governmental and military mailboxes since September 2025 to target universities, think tanks, and logistics firms across the United States and Europe. Initial contact often involves benign professional discourse followed by a link to a fraudulent OneDrive service—hosted via Cloudflare Workers—where the victim is prompted to copy a code and authorize access through the official Microsoft portal.

Following a successful incursion, adversaries secure comprehensive access to email and Microsoft 365 repositories, enabling document exfiltration, lateral movement within corporate infrastructure, and further attacks launched from the compromised identity. Proofpoint anticipates that the popularity of these schemes will continue to escalate as organizations transition toward passwordless and FIDO-based authentication. Experts recommend that organizations decisively disable the device code flow where feasible, restrict authorized device manifests, and educate personnel to never input authorization codes derived from unsolicited external communications.