Device-code phishing

Device-code flow is a legitimate OAuth pattern for input-constrained devices: the client shows a short code, the user opens a real identity-provider page, signs in, and types the code. The client then receives tokens. Device-code phishing steals that trust. The attacker starts the flow on their own client, gives the victim the code (or a link that lands them in the flow), and waits for the victim to approve it on the genuine login page.

That is why passkey- or MFA-themed helpdesk calls work so well with this technique. The lure is urgency to 'enrol a passkey' or 'fix SSO'. The click or SMS often opens a real Microsoft sign-in, not an obvious lookalike. Endpoint telemetry may be empty if the victim used a personal phone. Adversary-in-the-middle phishing is the sibling technique: a proxy captures password and session cookie. Same social engineering, different plumbing.

Microsoft’s September 2026 research on passkey-themed helpdesk impersonation (Storm-3121 / Storm-3032 and peers) is the current public lesson: after the foothold, actors enrol their own MFA method, run Graph reconnaissance, and pull SharePoint, OneDrive, and mail. Treat unusual sign-in plus a new authentication method as one incident, not two tickets.

Controls that hold: phishing-resistant MFA (passkey/FIDO) via Conditional Access; block or tightly restrict device-code and authentication-transfer flows where the business does not need them; require managed compliant devices for Exchange, SharePoint, and privileged Graph apps; admin consent for app registrations. Hunt: new MFA enrolments after anomalous sign-ins, high-volume Graph, bulk SharePoint downloads. Contain: revoke sessions and refresh tokens, remove attacker MFA methods, rotate app secrets the actor touched.

Put device-code abuse next to MFA fatigue and helpdesk social engineering in the IR playbook. Train the helpdesk itself: we do not cold-call staff on personal mobiles to 'set up a passkey' and we do not ask anyone to read out a device code on a voice call.