Device-code phishing with MFA bypass
A fake document-signing page tricked users into authorising an attacker device. Traced the rogue Entra ID registrations, revoked sessions and removed the devices.
The situation
Users received what looked like a request to sign a shared document. The link led to a convincing page that asked them to “verify” by entering a short code on a genuine Microsoft sign-in page.
That code was the attack. Device-code phishing abuses a legitimate sign-in flow meant for TVs and other devices that cannot show a full login screen. When a user enters the attacker’s code and completes MFA, they are actually approving the attacker’s device. MFA is passed, because the real user really did approve it.
What I did
- Confirmed the technique. Reviewed the alerts in Defender XDR and the sign-in activity in Entra ID to confirm that the device-code flow had been used, not a simple password theft.
- Found every rogue device. Traced the device registrations created through the attack in Entra ID, so nothing was missed.
- Cut off access. Revoked the affected users’ sessions so existing tokens stopped working, and removed the attacker-registered devices.
- Reported clearly. Wrote a leadership report explaining what happened, what was affected and what had been closed off, in plain language.
- Warned everyone. Sent a staff advisory showing what the fake page looked like and why “enter this code” requests deserve suspicion.
Outcome
The attack was contained: the rogue devices were removed and their sessions revoked. Leadership had a clear account of the incident, and staff knew what to look for next time.
What others can learn
- MFA alone does not stop this attack. The user completes MFA for the attacker. Conditional Access rules that restrict or block the device-code flow are the real control.
- Watch for new device registrations. A device appearing just after a suspicious email is a strong signal.
- Teach the pattern, not the brand. Attackers change the page design every week. “A website asked me to type a code into Microsoft” is the habit worth questioning.