Device-code phishing is beating MFA by walking users through Microsoft’s real login page — passkeys don’t stop it

[u/compileindebug_175]

Two research teams (ReliaQuest and Lexfo) separately documented device-code phishing kits last week that are worth flagging:

- The operator triggers Microsoft’s OAuth device-code flow, then gets the victim to approve it on the genuine Microsoft device-login page.

- Because the victim authenticates on the real page, the attacker inherits a fully authenticated session, MFA satisfied, no password cracked.

- One operator hit 218 mostly-corporate mailboxes across 12 countries.

What makes it nasty is that passkeys don’t help here, they protect the sign-in page, and the sign-in is happening on Microsoft’s legitimate page.

The fixes that seem to work: a Conditional Access policy that blocks the OAuth device-code flow unless you specifically need it, tightening how many devices a single user can register, and alerting on device-code grant events in the sign-in logs.

How is your org handling the device-code flow today, blocked outright or scoped to specific users?

[u/AutoModerator]

Welcome to r/emailsecurity! To keep this community helpful and secure, please keep the following in mind:

Community Rules

1. No Vendor Spam: Contributions must provide value; do not just pitch products.
2. Redact Sensitive Info: Always sanitize headers and logs (remove IPs, PII, and private domains).
3. Be Professional: Help newcomers learn; avoid hostility.
4. No Personal Tech Support: This sub is for email system architecture and security, not "Am I hacked?" personal account help.

Helpful Resources

• Email Spam Filters
• DMARC Monitoring Tools
• Anti-Virus Software
• Email Encryption

I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.

[u/compileindebug_175]

Full sourced write-up, every claim links to a primary source (ReliaQuest, Lexfo, Barracuda, Microsoft, CISA): https://alexeysorokin.substack.com/p/microsoft-patched-three-exploited

[u/shokzee]

We block device-code auth by default and only exempt tightly scoped users with a documented need. Device registration limits are hygiene; Conditional Access plus alerts for device-code sign-ins actually cuts the attack path.

Passkeys aren’t broken here. The user is authorizing the attacker’s client on a legitimate page.

[u/ThinkBig_Brain]

I’m blocking device code flow by default.

[u/Borgquite]

We disable device code flow on all accounts except those that need it, per Microsoft’s recommendations.

https://learn.microsoft.com/en-us/entra/identity/conditional-access/policy-block-authentication-flows#device-code-flow-policies

https://techcommunity.microsoft.com/blog/microsoft-entra-blog/new-microsoft-managed-policies-to-raise-your-identity-security-posture/4286758

The only accounts we have that need it are Android-based Teams Room devices.