Beware of Device Code Phishing – Source: www.darkreading.com

5 Min Read

Source: Andrea Danti via Alamy Stock Photo

COMMENTARY

Device codes are alphanumeric or numeric codes employed for authenticating an account on a device that does not have a standard login interface, such as a browser or input-limited devices, where it is not practical to require the user to enter text to authenticate. Such use cases include Internet of Things (IoT) devices, streaming apps like Netflix and Apple TV, and cloud applications. Device code authentication specifically binds authentication to a particular device.

How Attackers Use Device Code Phishing

Threat actors manipulate an application or service to generate a device code on their device and then deceive victims into entering the compromised device code for the attacker’s device through a legitimate authentication page of the service. This deception typically occurs through emails that seem to be from IT support, Microsoft Teams meeting invites, or other messages marked as “urgent.”

How Attackers Exploit Device Code Phishing

After the victim accesses the authentication page and inputs the code, they are requested to authenticate with their real credentials and multifactor authentication (MFA). After a successful sign-up, the service provider grants access and refresh tokens. The attacker steals these tokens to gain unauthorized access to the victim’s account, permitting lateral movement in the environment to access other services linked to the user without requiring a password.

Related:Victoria’s Secret Delays Earnings Call Due to Cyber Incident

Traditional phishing scams involving stolen usernames and passwords can be countered with MFA and conditional access policies. Device code phishing, however, relies on a stolen authenticated token, so the attacker does not need to meet conditional access controls or present MFA credentials to gain access to the victim’s account. The additional benefit of refresh tokens is that they allow attackers persistent access to victim accounts even after the initial authentication.

Why Device Code Phishing Is Growing in Popularity Among Attackers

Device code phishing is particularly dangerous because the technique doesn’t involve any malicious links or attachments that the victims must click for the attack to progress to the next level. Victims are required to input the device code and credentials into a legitimate login page, a method that makes it more challenging to recognize as an attack.

The attack is mostly successful because it is based exclusively on user habits. Individuals have grown used to authentication prompts from collaboration tools such as Microsoft Teams, so they will not normally question a request for authentication via device code.

Related:Exploitation Risk Grows for Critical Cisco Bug

Examples of Device Code Phishing Attacks

We have witnessed some high-profile device code phishing attacks and vulnerabilities in recent years. Some of these include:

The Russian state-sponsored cyber-espionage group APT29, or Cozy Bear, is affiliated with the Foreign Intelligence Service (SVR) that has been actively exploiting Microsoft Azure environments using malicious OAuth device code phishing. By deceiving victims into inadvertently authenticating the attacker’s device, APT29 exploited this technique to enter diplomatic organizations and corporations, reaping information without raising standard security alerts.

The Storm-2372 campaign is a device code phishing attack conducted by a Russia-linked threat actor to target governments, NGOs, and various industries in different regions since August 2024. The campaign attacks Microsoft Entra ID and other authentication services. Attackers send fake Microsoft Teams meeting invites or impersonate platforms such as WhatsApp (and Signal) to trick victims into creating a device code that is abused by malicious actors.

Mitigation Strategies Used Against Device Code Phishing

Related:Critical Bugs Could Spark Takeover of Widely Used Fire Safety OT/ICS Platform

(The five mitigations listed above primarily apply to Microsoft 365 platforms and/or sites and services that utilize OAuth, but not necessarily to all apps and services that use device codes.)

Conclusion

Unlike conventional credential harvest phishing, where victims must go to a phishing site before an attacker can harvest credentials, device code phishing merely asks victims to enter a code on a valid Microsoft page — something they are already trained to do in valid authentication processes, leading users to enter valid device codes that link the hacker’s device with their account. Countermeasures such as imposing conditional access, auditing OAuth activity, and educating users about unsolicited authentication requests can significantly reduce the risk. Even though device codes increase convenience, their vulnerability to phishing highlights the importance of robust authentication measures.

About the Author