Device Code Phishing Drives Microsoft 365 Account Takeovers and SharePoint Extortion

Researchers and incident responders are warning that attackers are increasingly abusing Microsoft Entra ID's OAuth 2.0 device code flow to hijack Microsoft 365 accounts through legitimate sign-in prompts rather than malware or software exploits. In these attacks, victims are tricked via vishing or phishing into entering an attacker-supplied code at Microsoft's device login page and approving MFA, which issues the attacker valid access and refresh tokens. Security firms say the technique can provide broad access to services including Microsoft Graph, Exchange Online, OneDrive, and SharePoint, and that password resets alone may not fully contain the intrusion because refresh tokens can persist across services.

The activity has been tied to data theft and follow-on abuse. ReliaQuest reported that the Helix extortion group used device code phishing, MFA abuse, and rogue authenticator registration to access victim Microsoft 365 tenants, enumerate SharePoint, and exfiltrate data before extortion; reported victims include Medtronic, Nissan, NAIC, Kodak, Infinite Campus, and the University of Nottingham. Separate investigations documented attackers signing in from foreign locations, registering multiple devices, creating hidden inbox rules to suppress replies, and using compromised mailboxes to send phishing messages at scale. Microsoft and security researchers recommend blocking or restricting device code authentication with Conditional Access, limiting SharePoint and device registration to managed devices, and monitoring Entra ID telemetry for AuthenticationProtocol set to device code, unusual travel, mailbox rule changes, and spikes in device registrations.