Hackers Bypass MFA by Abusing Microsoft's OAuth Device-Code Flow for Session Hijacking
A novel phishing technique tricks users into completing multi-factor authentication, allowing attackers to steal entire Microsoft 365 sessions by exploiting the OAuth device-code flow.
Cybercriminals have devised a sophisticated phishing scheme that circumvents multi-factor authentication (MFA) by leveraging Microsoft's legitimate OAuth device-code flow. Instead of attempting to steal credentials directly, attackers trick victims into approving a real Microsoft sign-in, thereby granting them full access to Microsoft 365 sessions. This method turns a feature designed for convenience on devices like smart TVs into a potent tool for session hijacking.
The attack begins with a convincing lure, often disguised as a document-sharing request or an account verification prompt. This message contains a code that the victim is instructed to enter on a genuine Microsoft sign-in page. Crucially, the victim proceeds through their normal password and MFA verification steps. However, the session tokens generated by this legitimate authentication process are not sent to the victim's device but are instead intercepted by the attacker's infrastructure.
Trend Micro researchers detailed how this technique exploits the OAuth device-code flow, a process typically used when a device cannot easily display a full login interface. In a normal scenario, a device requests a code, and the user enters it on another screen to authorize access. Microsoft then issues session tokens to the originating device, maintaining a secure connection. The attackers effectively impersonate the device, requesting a code and then directing the victim to authenticate it, thereby capturing the resulting tokens.
Once an attacker gains control of a Microsoft 365 session, the potential for damage is significant. They can register rogue devices to maintain persistent access, create hidden inbox rules to conceal their malicious activities and communications, and use the compromised mailbox to launch further phishing attacks against the victim's contacts. This makes detection challenging, especially for security tools focused solely on endpoint activity, as the initial compromise appears as a legitimate user login.
The observed campaign involved initial rapport-building, with attackers posing as business partners before sending the malicious link. The delivery chain often included compromised open redirectors and fake human-verification prompts to delay automated analysis, ultimately leading the victim to a fake document portal that initiated the device-code flow. This multi-stage approach highlights the evolving sophistication of phishing operations.
To combat this threat, administrators are advised to treat device-code sign-ins with increased scrutiny, especially if the workflow is not standard within the organization. Indicators of compromise include authentication activity from unusual locations or unmanaged devices, rapid device registrations, unexpected mailbox rule creation, and impossible-travel alerts. Organizations should consider disabling the OAuth device-code flow entirely if it is not a business necessity.
Beyond disabling the feature, organizations can implement several preventative measures. Limiting device registration, enforcing the use of managed devices for accessing sensitive data, and employing location-aware access controls can bolster security. Furthermore, user education remains paramount; employees must be trained to recognize and report any unexpected requests to enter or read out codes as suspicious. The adoption of phishing-resistant MFA methods is also a critical long-term strategy to mitigate such advanced session hijacking techniques.
This new report from Trend Micro details a sophisticated attack chain that begins with a seemingly benign conversation and escalates to a Microsoft 365 account takeover. The attack leverages the OAuth 2.0 device authorization grant, tricking victims into approving a malicious login request on a legitimate Microsoft page, thereby satisfying MFA. The attacker then receives session tokens, which can be used to register rogue devices and create persistent access through mailbox rules, effectively bypassing traditional security measures.