Widespread use of Microsoft 365 (“M365”) makes it a popular target for cybercriminals, and now, many threat actors are not relying on zero-day attacks to infiltrate; they are using the front door.

Unfortunately, legitimate features are being abused by threat actors to gain unauthorized access to systems and networks. While the convenience of a feature like Device Code Flow is attractive for real user access, it is doubly attractive to threat actors for gaining convenient access to M365 tenants.

So how can you mitigate or minimize the risk? Start by understanding how Device Code Flow works – and how threat actors can abuse it – to help secure your cloud environment from sophisticated phishing attacks.

Device Code Flow is a legitimate Microsoft authentication method that is designed to let users bypass entering complex passwords for applications and devices that do not easily allow user input (think Smart TVs, desk phone systems, and conference room devices). When leveraged, it allows access to M365 applications and data without typing the user’s password on that device.

Although the intent of Device Code Flow is to make sign-ins on keyboard-less devices easier, threat actors can abuse this feature to authorize M365 access on their own devices (e.g., laptops, desktops, and servers) as well. Not only does this bypass the need to enter a password, but under certain conditions, the Device Flow Code may bypass multifactor authentication.

A typical phishing attack using Device Code Flow to gain unauthorized access occurs via the following steps:

1. A threat actor requests a device code from Microsoft using an application of their choice.
2. Microsoft responds to the request with:
   a. A unique device code (ABCD-EFGH)
   b. A verification URL (https://microsoft.com/devicelogin)
3. The threat actor sends the code and the verification URL to the victim through a phishing email, Teams chat, SMS, or another communication channel.
4. The victim is instructed to visit the verification URL and enter the code generated by the threat actor. Depending on the wording of the instructions, the victim could believe they are doing this for multiple reasons. Some examples include:
   a. To join a Teams call.
   b. To view a document that was shared with them.
   c. To re-authenticate with Microsoft due to an internal issue.
5. The victim follows the instructions and enters the device code into the legitimate Microsoft verification URL.
6. Microsoft issues authentication tokens to the threat actor’s chosen application and registers the threat actor’s device in M365, allowing the threat actor to look like a normal authenticated user and potentially access victims’ data from Outlook, Teams, OneDrive, SharePoint, etc.

Threat actors often use open-source intelligence (OSINT) to target specific victims through specific communication channels or leverage previously compromised accounts’ known contact lists to make their scenario appear as legitimate as possible.

Device Code Flow attacks are harder for users to recognize than traditional phishing attacks because the victim is not sent to a fake Microsoft login page. Instead, they are directed to a legitimate Microsoft verification page and asked to enter a code which was supplied by the sender, not knowing the sender is a threat actor.

In this scenario:

• The user enters their credentials on a real Microsoft sign-in page.
• The user may be prompted and complete multifactor authentication normally.
• Microsoft receives and validates the authentication request.
• The resulting token is issued to the application that initiated the device code request.

As a result, the threat actor does not need to steal the user’s password. The victim unknowingly authorizes access for the threat actor, and the activity appears legitimate unless the organization is monitoring for device code authentication patterns and suspicious OAuth activity.

If Device Code Flow is not needed for normal business purposes, it can be restricted using Conditional Access Policies. Additional security measures include:

• Limiting users’ ability to register multiple devices without administrator approval.
• Monitoring Entra ID logs for Device Code Flow authentications.
• Reviewing application permissions.
• Increasing user awareness of device code prompts.

N1D has encountered numerous attacks in which Device Code Flow was abused to grant threat actors access to a user’s M365 account. As threat actors continue to leverage and layer their attack strategies and tools, by including AI resources and legitimate configurations like Device Code Flow, it is important for organizations to stay up to date and review their M365 configurations and alerting to prevent malicious access.