🎯 Device Code Authentication Phishing

The items that name it 3

• Passkey-themed social engineering leads to identity and cloud compromise
  writeup2026-09-09

  Victim is persuaded to enter a code on a legitimate Microsoft authentication page, issuing a token to an attacker-controlled client, bypassing MFA.

• Inside Knight Office, a New M365 AiTM Phishing Kit
  writeup2026-09-02

  Victim presented with a fake SharePoint/Teams page giving a verification/device auth code; instructed to sign in with Microsoft and paste the code into Microsoft's real 'deviceauth' login screen, tricking them into authorizing an attacker session

• Inside Kali365, a Device Code Phishing Ecosystem | Huntress
  writeup2026-06-11

  Attackers trick victims into completing the Microsoft device code flow, entering an attacker-generated code, granting the attacker persistent access even if passwords change or MFA is used