What if the invoice you just opened wasn't just a fake — but a live authentication session that bypassed your MFA by design?

On April 6, 2026, Microsoft Defender Security Research dropped a bombshell: a widespread phishing campaign that doesn't steal passwords. Doesn't crack MFA. It simply walks around both by abusing a legitimate OAuth flow most enterprises have never heard of.

Welcome to the age of AI-enabled device code phishing — where the lure is generated by a language model, the code is dynamically created the moment you click, and your clipboard is silently hijacked to paste the authentication token before you even realize what happened.

The Device Code Flow: A Feature, Not a Bug

Device code authentication is built into OAuth 2.0 for a legitimate reason: your smart TV, printer, or IoT device needs to log in without a keyboard. You get a short code on the device, enter it at microsoft.com/devicelogin on your phone, and the session authenticates.

The security tradeoff? Authentication happens on a different device than the session requesting it. The device initiating the login isn't cryptographically bound to your identity context. Threat actors saw this gap — and drove a truck through it.

Why This Campaign Is Different

Microsoft tracks this activity as part of the EvilTokens phishing-as-a-service (PhaaS) toolkit. But what makes this campaign distinct isn't just the scale — it's the automation infrastructure behind it:

1. Hyper-Personalized AI Lures

Generative AI creates targeted phishing emails aligned to the victim's actual job role. RFPs for procurement staff. Manufacturing workflows for operations teams. Invoices for finance. The emails don't look phishing-y because they're not templates — they're synthesized per target.

2. Dynamic Code Generation

Old device code attacks failed because the 15-minute timer started when the email was sent. If the victim opened it 20 minutes later? Expired code, dead attack.

This campaign generates the device code at click time. The moment you land on the malicious page, a backend proxy (hosted on automation platforms like Railway.com) requests a fresh code from Microsoft's identity provider. Your 15-minute window starts now, not when the attacker sent the email.

3. Clipboard Hijacking

The landing page silently copies the device code to your clipboard using navigator.clipboard.writeText. When you reach the legitimate Microsoft login page, all you do is paste. One paste, one confirmation, and the attacker's session is authenticated — with MFA intact, because you just completed it.

4. Browser-in-the-Browser

The final landing page renders a fake browser window inside the real one — complete with fake address bar showing microsoft.com/devicelogin. It looks like you navigated away. You didn't.

5. Domain Shadowing on Serverless Infrastructure

To evade domain blocklists, the campaign chains redirects through compromised legitimate domains and high-reputation serverless platforms like Vercel, Cloudflare Workers, and AWS Lambda. The phishing traffic blends in with legitimate enterprise cloud traffic.

The Attack Chain: From Recon to Financial Exfiltration

Phase 1: Target Validation (10–15 Days Before) — The attacker queries Microsoft's GetCredentialType endpoint to verify the email exists and is active. No login attempt. No failed auth log. Just a silent probe.

Phase 2: Delivery — High-pressure lures with direct URLs, PDFs with embedded links, or HTML attachments chaining through serverless redirect infrastructure.

Phase 3: The Handoff — A blurred document preview with a "Verify Identity" button. Click it, and you're redirected to the real microsoft.com/devicelogin — but the device code is already on your clipboard.

Phase 4: Authentication — You paste the code. You sign in. If already signed in to Microsoft, one confirmation click is all it takes. The attacker's backend polls every 3–5 seconds and captures the access token instantly.

Phase 5: Automated Reconnaissance & Targeting — Within minutes, the attacker uses Microsoft Graph to map your org structure. Only high-value personas (finance, executives, admins) get follow-on activity: new device registrations for Primary Refresh Tokens, malicious inbox rules, and email reconnaissance hunting for wire transfer details.

Why This Matters

Device code phishing isn't new. But the combination of AI-generated lures, dynamic infrastructure, and automated financial targeting marks a significant escalation since the Storm-2372 campaigns of February 2025.

The defenders' playbook assumed device code attacks were narrow and manual. This campaign proves they're now industrialized — and your Conditional Access policies might not cover the device code flow at all.

What You Can Do

  • Block device code flow in Microsoft Entra ID Conditional Access unless explicitly required for specific devices
  • Educate users that device code prompts from unexpected sources are suspicious — even if the URL looks legitimate
  • Monitor for anomalous device registrations and inbox rule modifications
  • Flag external emails with [EXTERNAL] headers and train staff to treat these with heightened suspicion
  • Review app consent — device code flows often bypass app consent scrutiny

The Bottom Line

MFA isn't broken. But it's not designed to protect against you authenticating a session you don't control. The device code flow was built for TVs and printers. Threat actors are using it to compromise enterprises at scale — with AI writing the lures, automation spinning the infrastructure, and your own clipboard doing the final handoff.

This isn't the future of phishing. It's April 2026.

— CyberClaw