We Need to Talk About Device Code Phishing

What it is

A Huntress explainer on device code phishing — abuse of the OAuth 2.0 device authorization grant (a 2019 extension meant for input-constrained devices like TVs) to steal Microsoft 365 / Entra ID OAuth tokens. The technique was first published by Dr. Nestori Syynimaa (AADInternals) in 2020; the summary names the campaigns, this piece supplies the mechanics and the detection-relevant infrastructure.

How it works

The attacker — not the victim's device — generates the legitimate 8-character device code. A phishing lure then tricks the target into entering that attacker-controlled code at the real microsoft.com/devicelogin page and approving the prompt. The attacker's backend immediately receives valid OAuth tokens.

flowchart LR
  A[Attacker generates<br/>device code] --> B[Lure delivers code<br/>to victim]
  B --> C[Victim enters code at<br/>real microsoft.com/devicelogin]
  C --> D[Victim approves prompt]
  D --> E[Attacker backend<br/>receives OAuth tokens]
  CA[Conditional Access:<br/>block device code flow] -. cuts .-> C

The reason this is hard to defend: because the victim authenticates on the genuine Microsoft login page, trained phishing red flags (sketchy domains, fake login forms) do not apply — and stealing the resulting token sidesteps MFA entirely.

Preconditions / Affected

Microsoft 365 / Entra ID tenants where device code flow is not blocked. The March 2026 EvilTokens campaign shows the operational tells: threat actors abused Railway.com (a developer PaaS) as a token-harvesting engine specifically to borrow its clean IP reputation and bypass Microsoft's risk scoring, and routed victims through multi-hop redirect chains — compromised websites, security-vendor URL rewriters, and Cloudflare Workers pages. Lures were highly personalized: construction RFPs, DocuSign, voicemail notifications. Storm-2372 built rapport first over WhatsApp, Signal, or Teams while impersonating prominent individuals.

What to do

The only mitigation the page names is Microsoft Conditional Access in Entra ID — policies that evaluate each sign-in on signals (user, location, device, risk) and apply controls. The article points to a Microsoft-managed Conditional Access policy that blocks device code flow (the text is cut off mid-sentence and gives no configuration steps). Huntress sardonically labels reliance on anything weaker "hope-as-a-service."

Caveats

This is a recap of a June 2026 Tradecraft Tuesday episode, not an advisory — no detection queries, IOCs, or step-by-step Conditional Access configuration are provided, and the block-device-code-flow guidance is truncated. Treat the Railway.com / redirect-chain details as hunt leads to develop, not a finished detection.