How Hackers Bypass Microsoft 365 MFA with Sophisticated New Phishing Attacks

Welcome back to Tech Brewed! In today’s episode, host Greg Doig dives into a sophisticated new phishing campaign that has cybersecurity experts raising alarms. This isn’t your run-of-the-mill password theft—attackers are now cleverly bypassing Microsoft 365’s multi-factor authentication using a tricky method known as the OAuth 2.0 device code flow. Even if you’re following best practices, these threat actors may still find a way in, targeting key industries like tech, manufacturing, and financial services.

We’ll explore exactly how this attack works, the red flags you need to recognize, and practical steps to protect yourself and your organization. So, whether you’re an IT professional or just someone wanting to stay safe online, grab your favorite brew and tune in. It’s time to outsmart the latest cyber threats together!

Transcript

0:00

Welcome back, tech enthusiasts. I'm your host, Greg Doig, and thanks for tuning in. Today we're talking about a sophisticated new phishing campaign that's causing quite a stir in the cybersecurity world. And here's the scary part. It can bypass Microsoft 365 multi-factor authentication. Yep. Even if you're doing everything right, attackers may still be able to sneak in. Let's unpack what's going on here. Most phishing attacks try to steal your username and password. Basic stuff. And with MFA turned on, you've usually got a strong safety net. But this new attack, well, it plays by a different rulebook. Threat actors are now abusing something called the OAuth 2.0 device authorization grant flow, often just called the device code flow. Normally, this is used legitimately by devices like smart TVs or command line tools that don't have a full sign-in interface. Here's the twist. The attackers send you an actual Microsoft page, not a fake one, and ask you to enter a device code they provide. Once you do that and complete your MFA, the attackers intercept the resulting authentication tokens in real time. That means they get access without ever touching your password. And worse, they get persistent access to Outlook, Teams, OneDrive, SharePoint, and even some admin-level capabilities. The campaign has been active since late 2025 and is heavily concentrated in North America, especially the United States. And the industries being targeted, no surprise here, tech, manufacturing, financial services. These are sectors where attackers know the data is valuable and the access is lucrative. So how can you spot one of these attacks? Here are some red flags to watch for. You're suddenly asked to enter a device code to verify your identity. An email or phone call claims to be from IT and pressures you to log in immediately. You get an MFA prompt you didn't initiate, or a workflow feels off, especially if it appears out of nowhere. This attack relies heavily on social engineering, timing, and credibility. The attacker's goal is

simple: 2:11

make you think you're doing something legitimate. Now here's how you can protect yourself and your organization. Ready? 1, never enter a device code unless you personally initiated it. 2, decline MFA prompts you didn't request. 3, verify URLs before logging in, even if they look familiar. 4, report suspicious emails immediately. Don't wait. 5, if you think you might have interacted with one of these attacks, contact IT as soon as possible. Token theft can be reversed, but only if we know it's happened. This phishing campaign is a perfect reminder that cyber threats continue to evolve, and even our best defenses can be manipulated. But with awareness, vigilance, and quick reporting, we can stay ahead of attacks like these. If you found this helpful, make sure to subscribe, share this episode with your friends and teammates, and help someone else stay secure today. I'm Greg Doig. Once again, thanks for listening. Stay safe, stay skeptical, and I'll talk to you soon.