AI-Enabled Device Code Phishing Campaign Exploits OAuth Flow for Account Takeover

Why It Matters

The technique subverts MFA, giving threat actors rapid, stealthy access to enterprise identities and long‑term footholds, raising the stakes for cloud security defenses.

Key Takeaways

• Attack exploits OAuth device code flow to bypass MFA
• AI-driven automation generates live codes, evading detection
• Campaign uses compromised domains and serverless hosting for delivery
• Threat actors obtain access tokens within minutes of user login
• Long‑term persistence achieved via Primary Refresh Tokens and inbox rules

Pulse Analysis

The OAuth Device Code flow was originally designed for low‑input devices, allowing a user to enter a short code on a separate device to authenticate. Because the flow separates the code entry from the originating session, it sidesteps traditional credential checks and can be completed without a password. Attackers have recognized this architectural gap and now weaponize it, turning a convenience feature into a covert backdoor that sidesteps multi‑factor authentication and exploits the trust relationship between the identity provider and the user’s active session.

Microsoft’s investigation reveals a sophisticated, AI‑assisted infrastructure that automates every step of the attack. Threat actors conduct reconnaissance weeks in advance, confirming active accounts before delivering phishing lures via compromised domains and serverless hosts that evade sandbox analysis. Once a victim clicks a malicious link, a hidden script generates a live device code, copies it to the clipboard, and prompts the user to paste it into the legitimate login page. The script then polls the authentication endpoint, capturing a valid access token as soon as the user completes MFA. This end‑to‑end automation compresses the attack timeline to minutes, dramatically reducing the window for detection.

For enterprises, the emergence of device‑code phishing signals a new frontier in identity‑based threats. Traditional defenses that focus on password theft or phishing URL blocking may miss this vector, as the user willingly interacts with a legitimate login portal. Organizations must enforce strict monitoring of anomalous device registrations, implement conditional access policies that flag device code usage, and educate users about the risks of copying and pasting authentication codes. As AI continues to streamline attack orchestration, security teams need to adopt behavior‑based analytics and zero‑trust principles to mitigate the growing risk of OAuth abuse.