Device code phishing has moved into widespread campaigns

By September 2025, Proofpoint was observing widespread campaigns exploiting device code phishing, a technique previously associated mainly with targeted operations and red teams. The attacker socially engineers the victim into signing in with valid credentials through the device authorisation flow, thereby obtaining service tokens that grant access to the victim's Microsoft 365 account. In a campaign on 8 December 2025, emails referenced a purported document titled "Salary Bonus + Employer Benefits Reports 25". The link led to an attacker-controlled site carrying the target company's own branding, where the user had to complete a supposed secure authentication step using a code. Once the code was supplied, the attacker had access.

What this means for your organisation

Multi-factor authentication does not stop this, because the user genuinely approves a real sign-in. The attacker obtains tokens rather than passwords, so a password reset afterwards is not sufficient on its own. The lure is built for the salary and bonus season, when the threshold for clicking is low.

Berigo recommends

• Block the device code flow for all users with a conditional access policy. This is the single strongest measure.
• Grant exceptions only where a specific device type requires it, and document them.
• Revoke active tokens, not just passwords, when an account is suspected compromised.
• Tell staff that no legitimate internal process asks them to enter a code from an emailed link.

Source

• proofpoint.com