---
title: "Device Code Phishing: Turning a Convenience Feature Into an MFA Bypass"
url: https://daily.dev/posts/device-code-phishing-turning-a-convenience-feature-into-an-mfa-bypass-ahmi9uip7
source_url: https://www.trendmicro.com/en_us/research/26/g/device-code-phishing.html
type: article
source: "Trend Micro"
published: 2026-07-22T19:30:24.527Z
updated: 2026-07-22T19:30:51.238Z
tags: ["microsoft", "authentication", "phishing", "oauth"]
reading_time: 9
upvotes: 0
comments: 0
language: en
---

> ## Documentation Index
> Fetch the complete documentation index at: https://daily.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Device Code Phishing: Turning a Convenience Feature Into an MFA Bypass

**[Trend Micro](https://daily.dev/sources/trendmicro)** · 9 min read · 0 upvotes · 0 comments

## Summary

Device code phishing abuses the OAuth 2.0 device authorization grant — a legitimate flow designed for input-limited devices like smart TVs — to bypass MFA without stealing passwords. The attacker initiates a real Microsoft device-code request, tricks a victim into approving it on the genuine Microsoft sign-in page, and receives the resulting tokens. A real-world Microsoft 365 case is detailed: attackers built trust via multi-message conversations, used Google Sites and open redirectors to evade URL filtering, and after token capture registered rogue devices, created hidden inbox rules, and launched further phishing campaigns entirely from the cloud. Defenses include blocking the device-code OAuth flow via Conditional Access where not needed, restricting device registration, enforcing named-location policies, enabling Continuous Access Evaluation, and training users to treat unexpected code-entry requests as red flags. Detection queries for Microsoft Entra ID sign-in logs and MITRE ATT&CK mappings are provided, along with IOCs.

## Full article

daily.dev links to this article rather than hosting it. Read it at the original source: <https://www.trendmicro.com/en_us/research/26/g/device-code-phishing.html>

## Similar posts on daily.dev

- [We Need to Talk About Device Code Phishing](https://daily.dev/posts/we-need-to-talk-about-device-code-phishing-x88bpk5tq) · Huntress Blog · 0 upvotes · 0 comments
- [When checking the URL isn't enough: phishing via the Microsoft identity platform](https://daily.dev/posts/when-checking-the-url-isn-t-enough-phishing-via-the-microsoft-identity-platform-wtxnir48k) · Securelist · 0 upvotes · 0 comments
- [New phishing campaign tricks employees into bypassing Microsoft 365 MFA](https://daily.dev/posts/new-phishing-campaign-tricks-employees-into-bypassing-microsoft-365-mfa-2reed6azp) · CSO Online · 0 upvotes · 0 comments

---

Tags: [#microsoft](https://daily.dev/tags/microsoft), [#authentication](https://daily.dev/tags/authentication), [#phishing](https://daily.dev/tags/phishing), [#oauth](https://daily.dev/tags/oauth)

[View this post on daily.dev](https://daily.dev/posts/device-code-phishing-turning-a-convenience-feature-into-an-mfa-bypass-ahmi9uip7)