OAuth Device Code Phishing: The Silent Attack

 

There are attacks that try to steal your password, and others that simply wait for you to do the right thing, this is one of them, and it has been gaining traction over the past months.

This is a threat that does not need your credentials to gain access to your Office 365 tenant. A silent, efficient technique capable of bypassing MFA without exploiting vulnerabilities or stealing passwords. Discreet, effective, and potentially leading to serious security incidents.

The attacker leverages legitimate infrastructure under their control, allowing them to craft a far more convincing scenario and bypass traditional security controls.

This represents a clear shift in phishing tactics, moving from credential theft to token abuse.

 

How It Begins

Like most attacks, it starts with an email, an unpaid invoice, a pending contract, something that requires immediate attention.

Social engineering plays a critical role here. If the attacker has performed prior reconnaissance and tailors the message through spear phishing, the probability of success increases significantly.

 

 

Attack Flow

Email received, a contract pending signature.

Illustration 1 Social engineering hook

 

Security Evasion Techniques

Geofencing detection is used to trigger the malicious redirection only when specific conditions are met, typically based on operating system language, keyboard settings, and IP geolocation.

The attacker’s infrastructure validates the victim using a custom header, X-Antibot-Token, ensuring that only real browsers can proceed in the flow. Once this validation is completed, a backend request is initiated, allowing the attack to continue into the OAuth process and guiding the victim toward a legitimate authentication flow controlled by the attacker.

Illustration 2 Anti Bot header Token

 

Abuse of the OAuth Flow

At this stage, the attacker abuses a legitimate OAuth authentication flow.

Illustration 3 ANY.RUN Analysis

A device code is generated by the identity provider, in this case, Microsoft.

Illustration 4 ANY.RUN Analysis

The victim enters the code believing they are accessing a legitimate document.
In reality, they are granting full access to their account.

The user completes the authentication process, including MFA.

At that exact moment, the attacker receives valid OAuth tokens, both access and refresh tokens.

It is important to highlight that credentials are never exposed to malicious infrastructure.

 

Post-Compromise Capabilities

·       Access to corporate email and SaaS applications

·       Persistence through refresh tokens, typically renewed every two hours

·       Lateral movement within the tenant

·       Ability to operate without triggering credential-based alerts

·       The attacker blends into normal activity, hidden within the noise of permissions, tokens, and third-party integrations, achieving initial access with minimal visibility.

 

Detection Challenges

·       This attack bypasses multiple traditional security controls:

·       No credential theft, password-based detection mechanisms fail

·       No malicious domain involved, URL filtering becomes ineffective

·       Valid MFA authentication, the login appears legitimate

·       Encrypted traffic, limited visibility without deep inspection

·       Detection must evolve toward monitoring OAuth activity and behavioral analysis.

 

Technical Artifacts Observed

·       Endpoints:

o   /api/device/start

o   /api/device/status

·       Use of JavaScript to orchestrate the OAuth flow

·       Custom headers such as X-Antibot-Token

 

The user does not fail.
The system does not fail; and yet, the attacker succeeds.

 

Technical Conclusion

This type of attack is extremely easy to execute, yet highly complex for organizations to detect.

Attackers can escalate privileges and leverage access for various objectives, including BEC scams, malware deployment, or data exfiltration, depending on their motivation. In some cases, they may simply act as Initial Access Brokers, leaving the door open and selling that access to other threat actors.

Email protection remains critical, but it is no longer sufficient on its own. Without additional controls such as SaaS permission management and token visibility, organizations remain exposed.

The impact can be severe even in environments protected by MFA and secure email gateways. The attack may originate from corporate channels and be detected, or it may bypass them entirely if delivered through personal vectors such as SMS, WhatsApp, Telegram, or personal email on BYOD devices.

At that point, the attack moves beyond the corporate perimeter into the personal space, where success rates increase dramatically and the impact becomes significantly greater.

 

This attack does not break MFA.
It does not steal credentials.
It does not exploit known vulnerabilities.

It simply uses the system exactly as it was designed to work.

And that is precisely the problem.