MFA is no longer enough: Device Code phishing steals permissions and maintains access

In recent years, many organizations have considered multi-factor authentication (MFA) as the strongest barrier against accountability. However, the attackers have evolved and now exploit the legitimate authorization flows themselves to obtain persistent access without the need to steal passwords: a modality that requires rethinking what "be protected" means.

A worrying example is the so-called Device Code phishing, where the victim does not deliver credentials to a fraudulent site, but rather accepts - through a Microsoft page or another legitimate supplier - a code or consent that emits tokens of access to the attacker. The result is an account committed even though authentication and MFA were legitimately completed because what has been committed is not credentials but authorization granted to a malicious application.

This type of attack exploits a technical truth: the mail and cloud systems rely on tokens and application consensus as well as passwords. Therefore, traditional defenses focused on detecting login with stolen passwords or blocking suspicious PIs may be out of date. Attacks who use legitimate authorisation flows often circumvent rules that seek classic phishing patterns or MFA bypass and can maintain long-term access if the misuse of tokens is not detected.

The operational implications are significant. The SOC and IR teams are caught investigating scattered signals after the attacker has already set up rules for forwarding, delegating access or drawing sensitive information. This increases the probability of data loss and the complexity of the remediation, in addition to firing repetitive manual workloads that exhaust resources.

To advance this tactic, it is necessary to combine technical measures, behavior-based detection and automation. Technically, restrict application consent, review OAuth's permissions regularly and implement conditional access policies are essential steps; Microsoft documents the flow of Device Code and its risks in its guide for developers and administrators, which should be reviewed: https: / / learn.microsoft.com / en-us / azure / active-directory / develop / v2-oauth2-device-code.

In detection it is key to move from the static indicator to the analysis of anomalies: concentrate on changes in account behavior - shipping peaks, creation of reshipment rules, granting of permits to external applications, or access from geographical or atypical devices -. The intelligence that models the normal behavior of users and applications allows to identify early signals that signature-based systems do not see, and automate responses (revoke consent, force revalidations, block applications) reduces exposure time.

Not everything is technology: the training must be updated to allow users to identify legitimate applications for authorisation in the face of social engineering attempts that instruct "to introduce a code" or "to authorize an app." Teach to verify application names, developer IDs and authorisation contexts can prevent many initial incidents. To understand the scope and impact of mail fraud, security teams can consult alerts and public recommendations about Business Email Commitments, such as those of CISA: https: / / www.cisa.gov / uscert / ncas / alerts / aa20-283a.

Adopting phishing-resistant authentication methods, such as FIDO2 keys and policies that minimize the use of long-term tokens, helps to increase friction for attackers. Also, integrating behavioral detection with automated playbooks into the safety platform reduces the operating load of the SOC and accelerates containment: automation prevents analysts from "chasing alerts" and allows them to act before undue access becomes a data leak.

For teams who want to deepen these tactics and see practical cases, there are events and webinars where experts analyze recent attacks and operational solutions; attending sessions with technical and operational vision helps translate general recommendations into rules, alerts and automation specific to their environment. In parallel, organizations should conduct regular audits of consented applications, set up alerts for configuration changes to critical accounts and run response exercises against OAuth abuse scenarios.

In short, MFA remains valuable but is no longer an absolute guarantee against the commitment of accounts: modern defense requires controlling who gets permits, monitoring how these permits are used, and automating behavior-based research and mediation. Adopting restrictive consent policies, phishing-resistant authentication, anomaly-based detection and a configurable automated response are the pillars to reduce the risk of Device Code phishing and similar attacks.