Device Code Phishing: A Dangerous New Scam You Need to Know About

How the Scam Works

Here’s where the hackers get clever. To prepare for this attack, the threat actor starts to log into a legitimate service you already belong to (e.g., Microsoft, Netflix, third-party app, etc.) using your account’s user ID and gets a legitimate device code (meant for you) sent to them instead.

The attack usually happens in these steps:

1. The Setup: Hackers generate a real device code using your account information
2. The Contact: The attackers contact the end-user via third-party messaging platforms such as WhatsApp/ Signal or even Microsoft Teams. Mostly they share context related to fake meeting invitations/ calendar invitations with a code (device code)
3. The Trick: They send you a message that looks like it’s from Microsoft Teams, your IT department, or another trusted source, asking you to enter a code on a legitimate Microsoft login page
4. The Trap: When you enter the code and log in, this tricks the login service into believing that the other device under the control of the hacker is yours

The generated Device Codes are only valid for 15 minutes once they are created. As a result, they have to have real-time communication with the victim.  They need the victim to expect the “invitation”. 

Real Examples of These Attacks

Example 1: Fake Microsoft Teams Meeting

A phishing attack that masquerades as Microsoft Teams meeting invitation, delivered through email. When the victims click the meeting invitation, they are prompted to authenticate using a threat actor-generated device code. You might get an email that looks like your boss is inviting you to an urgent meeting, but when you click to join, you’re asked to enter a code to “verify your identity.”

Example 2: Fake Military Official Contact

Volexity are cyber-specialists.  In their investigation of an incident, they reviewed emails to the user leading up the time of the authentication event. This review identified a suspicious email just moments before the login activity from an email address purporting to be from someone with the name of a high-ranking official from the Ukrainian Ministry of Defence. In this case, hackers pretended to be important government officials to trick their targets.

Example 3: Signal Messenger Scam

Through its investigations, Volexity discovered that Russian threat actors were impersonating a variety of individuals in order to socially engineer targets. In one case, This individual then requested the victim move off Signal to another secure chat application called Element. The attacker then had the victim join an Element server they controlled under the domain sen-comms[.]com.

Why This Scam Is So Dangerous

There are several reasons why device code phishing is particularly scary:

It Uses Real Websites: A user who is up on their Security Awareness Training might know to be rightfully suspicious of links, but may let their guard down when they see https://microsoft.com/devicelogin as the URL. You’re not being sent to a fake website – you’re using the real Microsoft login page!

It Bypasses Security Training: Most security training teaches people to look for suspicious links or fake websites. But in this scam, everything looks completely legitimate because it IS legitimate – except for the code you’re entering.

Long-Term Access: The additional benefit of refresh tokens is that they allow attackers persistent access to victim accounts even after the initial authentication. Once hackers get in, they can stay in your account for a long time.

Hard to Detect: There’s no true exploitation occurring during this attack outside of tricking someone into using the device code flow when they shouldn’t. Since everything is using legitimate systems, security software has a hard time catching it.