Device Code Flow Phishing: A Growing Threat and How to Block It
A legitimate Microsoft sign in feature called device code flow is being abused in a phishing technique that skips the fake login page entirely, and it is catching well protected organisations off guard.
A Phishing Technique That Does Not Need a Fake Login Page
Most phishing training focuses on spotting a fake login page, a slightly wrong domain, or a suspicious sender. Device code flow phishing sidesteps all of that by sending the target to a completely genuine Microsoft sign in page. It abuses a legitimate feature built for devices without a keyboard or browser, television apps, smart displays, and command line tools, called device code flow, and it has been used in real attacks against organisations that considered themselves well protected.
How the Attack Actually Works
Device code flow lets a device with no easy way to sign in generate a short code, and ask the user to enter that code separately at microsoft.com/devicelogin on a browser they already trust. It exists for legitimate scenarios such as signing into a meeting room device. Attackers exploit this by generating a code themselves, then sending it to a target inside a message crafted to look like a calendar invite, a Teams meeting request, or an IT support prompt. The target enters the code on the real Microsoft page, completes their normal sign in including multi factor authentication, and unknowingly hands the attacker a valid, working session for their account, without ever typing a password into anything fake.
Anatomy of the Attack
The Lure
A message arrives that looks like a genuine calendar invite or support request, asking the target to enter a short code.
A Genuine Sign In Page
The target signs in through the real Microsoft page, including their normal multi factor prompt.
A Stolen Session, Not a Password
The attacker receives a valid, working session token, which is far harder for a user to notice going wrong.
Why This Slips Past Standard Defences
Because the sign in genuinely happens on a real Microsoft domain, and the user genuinely completes multi factor authentication, most of the usual red flags are simply not there. There is no suspicious link to hover over and no fake page to inspect. The session token the attacker receives is treated by Microsoft 365 as a normal, valid session, which means the attack can succeed even against users who are otherwise cautious and well trained.
Blocking It With Conditional Access
Very few standard users in most businesses have a genuine need for device code flow at all, it exists mainly for shared devices, kiosks, and certain command line tools. Microsoft Entra Conditional Access lets you restrict authentication flows directly, so device code sign in can be blocked for the vast majority of accounts and only permitted for the specific service accounts or devices that actually require it. This is exactly the kind of control we put in place through our Zero Trust Assessments service, reviewing which authentication methods your business actually needs and closing off the ones it does not. Pair it with our Identity and Access Management service for a full review of how your organisation authenticates users end to end.