Device code phishing takes over a Microsoft 365 account without stealing the password or MFA code

Device code phishing abuses Microsoft’s OAuth 2.0 device authorization flow. The victim enters a code sent by the attacker at microsoft.com/devicelogin, signs in normally and confirms MFA, thereby granting the attacker a valid access token to the Microsoft account. CERT-EE has observed such attacks in Estonian cyberspace in recent months.