Phishing mobile devices, with DeviceCode phishing and QR codes As protections for endpoints (Laptops, Virtual-Desktops, …) are getting better and sometimes really tough to bypass, it might be time to move along. One of the next weaker devices might be mobile ones, in that case smartphones. Imho the MDM is weaker nowadays then a fully featured EDR with webproxies and packet inspection. For a good user experience, we can combine “E-Mails, QR-Codes, DeviceCode phishing and Azure CDN fronting”. tl;dr E-Mails without links, attachments and images will often make it to inbox QRCodes do not need to be images, they can also be Unicode or html tables Azure CDN Fronting spares the handling of a trusted domain, SSL certificate and all the nasty things around DeviceCode phishing is still doing great in most environments A GraphAPI token for Azure is quite powerful Depending on the kind of phishing the loot might be even a fully featured PRT!

What’s a Device Code? When you want to log in and authenticate to Entra ID, you may not always have the same input capabilities as you have on your computer. This can be devices without keybo…

Threat actors are targeting technology, manufacturing, and financial organizations in campaigns that combine device code phishing and voice phishing (vishing) to abuse the OAuth 2.0 Device Authorizati...

A new wave of device code phishing shows how threat actors are scaling account compromise using AI and end‑to‑end automation. This campaign goes beyond traditional phishing by generating live authenti...

 A hacking outfit potentially linked to Russia is running an active operation that uses device code phishing to target Microsoft 365 accounts of individuals at organisations of interest. The targets are in the government, non-governmental organisations…

Many organizations rely on multi-factor authentication as a key safeguard, but attackers are increasingly bypassing it by abusing legitimate authentication workflows instead of stealing passwords. The webinar “Stop chasing alerts: Automating email security with behavioral AI” will show how Device Code phishing, BEC, and ATO attacks can evade traditional defenses and how behavioral AI can help detect compromise earlier. #DeviceCodePhishing #AbnormalAI #BleepingComputer #NovantHealth

Microsoft warned of a large-scale phishing campaign that abuses the OAuth device code flow to obtain access tokens and bypass multi-factor authentication. Attackers use AI-driven automation, dynamic device-code generation via in-page JavaScript, and cloud-hosted redirects through compromised domains to scale and evade detection. #Microsoft #DeviceCodeFlow

Researchers spotted multiple groups using the same technique

Phishing con código de dispositivo explota OAuth en Microsoft 365: así toman cuentas con un token y qué ajustes cortan ese acceso silencioso. La nueva ola de intrusiones aprovecha OAuth 2.0 —un sistem...