State actors are abusing OAuth device codes to get full M365 account access - here's what we know

World Password Day 2025.

• Proofpoint reports phishing surge abusing Microsoft OAuth 2.0 device code flow
• Victims enter codes on real Microsoft domains, granting attackers access tokens
• Proofpoint advises blocking device code flows

Cybercriminals, including state-sponsored threat actors, are increasingly abusing Microsoft’s OAuth 2.0 device code authentication flow to take over Microsoft 365 accounts.