phishingšInternationalThe Hacker News
Russia-Linked Hackers Use Microsoft 365 Device Code Phishing for Account Takeovers
Friday, December 19, 2025
What
A phishing campaign using device code authentication workflows to steal Microsoft 365 credentials and facilitate account takeovers.
Where
Targets include government, think tanks, higher education, and transportation sectors in the U.S. and Europe.
When
Ongoing since September 2025.
Key Factors
- ā¢Use of compromised email addresses for benign outreach to build rapport with targets.
- ā¢Phishing technique involves redirecting victims to a legitimate Microsoft login page after entering a code.
- ā¢Availability of user-friendly crimeware tools like Graphish and SquarePhish enabling low-skilled actors to conduct sophisticated attacks.
Takeaways
- āImplement Conditional Access policies to block device code flow for all users.
- āThe rise of device code phishing tactics highlights the need for enhanced user education on authentication methods.
- āOrganizations should consider an allow-list approach for device code authentication to mitigate risks.
Read Full Article
Opens original article on The Hacker News
