Device code phishing: are your MFA controls keeping up?

TL;DR: Device code phishing is rising through PhaaS kits that let attackers bypass MFA by capturing Microsoft 365 access tokens, while victims complete a legitimate sign-in that looks normal in logs, according to Coalition. The real failure is that MFA can succeed while the attacker still inherits a valid token, so review and revocation have to move from password events to token and session control.

Editorial analysis by NHI Mgmt Group, based on content published by Coalition: “A New Era Of Social Engineering: The Device Code Phishing Boom”.

By the numbers:

• Coalition Incident Response handled multiple business email compromise cases in June and July 2026 that stemmed from device code phishing.

Key questions

Q: What breaks when device code flow is allowed without tight governance?

A: The control that breaks is the assumption that the person completing MFA is the same person benefiting from the resulting session.

Q: Why do phishing attacks still succeed even when spam filters and MFA are in place?

A: Phishing succeeds because it targets human judgment and can bypass technical controls through deception, urgency, and credential theft.

Q: How can security teams tell whether a device code login was malicious?

A: Look for deviceCode authentication, mismatched user agents, unusual IP addresses, repeated code requests, and device registrations that do not fit normal business behaviour.

Practitioner guidance

• Restrict device code flow where it is not required Block the device flow entirely for environments that do not need it, and create explicit exceptions only for defined use cases and users.
• Review sign-in telemetry for device code anomalies Monitor interactive sign-in logs for deviceCode authentication, user-agent mismatches, unusual IPs, and repeated device registration attempts under the same account.
• Preserve audit data beyond default retention windows Ensure Unified Audit Logs and Entra sign-in logs are retained long enough to support investigations when incidents are discovered days or weeks later.

Bottom line: Device code phishing turns a legitimate MFA completion into attacker-held access, so the compromise can hide inside a normal sign-in flow.

Explore further

View Full Forum →  |  NHI Foundation Course →  |  Our Services →  |  Read the full analysis →