{"id":57413,"date":"2026-04-09T11:18:40","date_gmt":"2026-04-09T01:18:40","guid":{"rendered":"https:\/\/www.cloudproinc.com.au\/?p=57413"},"modified":"2026-04-09T11:18:43","modified_gmt":"2026-04-09T01:18:43","slug":"ai-powered-device-code-phishing-now-bypasses-mfa-what-australian-organisations-must-do-next","status":"publish","type":"post","link":"https:\/\/www.cloudproinc.com.au\/index.php\/2026\/04\/09\/ai-powered-device-code-phishing-now-bypasses-mfa-what-australian-organisations-must-do-next\/","title":{"rendered":"AI-Powered Device Code Phishing Now Bypasses MFA \u2014 What Australian Organisations Must Do Next"},"content":{"rendered":"\n

Multi-factor authentication has been the security baseline for years. Most Australian organisations treat it as the final checkpoint \u2014 if MFA is in place, accounts are protected. That assumption just got a serious challenge.<\/p>\n\n\n\n

Microsoft Defender Security Research has exposed a widespread phishing campaign that bypasses MFA entirely. It abuses a legitimate feature built into Microsoft’s identity platform \u2014 the device code authentication flow \u2014 and pairs it with AI-generated lures and automated infrastructure to compromise organisational accounts at scale.<\/p>\n\n\n\n

For Australian businesses relying on Microsoft 365, this is not a theoretical risk. It is an active campaign, and it works.<\/p>\n\n\n\n

What Is Device Code Phishing?<\/h2>\n\n\n\n

Device code authentication is a legitimate OAuth 2.0 flow designed for devices with limited input capabilities \u2014 smart TVs, printers, IoT endpoints. A user receives a short code, enters it on a separate browser, and authentication completes on the original device.<\/p>\n\n\n\n

The problem is that this flow decouples the authentication from the originating session. When a threat actor initiates the flow and sends the code to a victim through a phishing email, the victim unknowingly authorises the attacker’s session. MFA completes normally \u2014 the user enters their password, approves the push notification \u2014 but the resulting tokens go straight to the attacker.<\/p>\n\n\n\n

No credential theft. No password interception. MFA works exactly as designed, and the attacker still gets in.<\/p>\n\n\n\n

Why This Campaign Is Different<\/h2>\n\n\n\n

Device code phishing is not new. Microsoft documented Storm-2372 running a similar campaign in February 2025. What makes this April 2026 campaign a significant escalation is the level of automation and AI involvement across the entire attack chain.<\/p>\n\n\n\n

AI-Generated Lures<\/h3>\n\n\n\n

Threat actors are using generative AI to craft hyper-personalised phishing emails. These are not generic “your password is expiring” messages. The lures are tailored to the victim’s role \u2014 RFPs for procurement teams, invoices for finance, manufacturing-specific workflows for operations staff. The days of spotting phishing by poor grammar are over.<\/p>\n\n\n\n

Dynamic Code Generation<\/h3>\n\n\n\n

Older device code attacks pre-generated codes and embedded them in emails. The 15-minute expiration window meant most codes expired before the victim even opened the message. This campaign solves that problem entirely. The code is generated the instant the victim clicks the link, giving the full 15 minutes from the moment of interaction.<\/p>\n\n\n\n

Automated Infrastructure at Scale<\/h3>\n\n\n\n

The attackers are not running a single phishing server. They leverage platforms like Railway.com, Vercel, Cloudflare Workers, and AWS Lambda to spin up thousands of short-lived polling nodes. These are legitimate, high-reputation cloud services \u2014 the same ones many Australian organisations use in production. Traditional domain blocklists and reputation filters do not catch this traffic because it blends in with normal enterprise cloud usage.<\/p>\n\n\n\n

Browser-in-the-Browser Deception<\/h3>\n\n\n\n

The final landing page uses a browser-in-the-browser technique \u2014 a simulated browser window rendered inside the web page. The victim sees what looks like a legitimate Microsoft login prompt, complete with the official microsoft.com\/devicelogin URL. The device code is even automatically copied to the clipboard to reduce friction.<\/p>\n\n\n\n

The Post-Compromise Playbook<\/h2>\n\n\n\n

What happens after the attacker obtains tokens is just as concerning. The campaign follows a structured post-compromise approach:<\/p>\n\n\n\n

Targeted reconnaissance.<\/strong> Attackers use Microsoft Graph API to map the organisational structure, identifying users with financial authority, executive access, or administrative privileges.<\/p>\n\n\n\n

Persona filtering.<\/strong> Not every compromised account gets the same treatment. The attackers filter for high-value targets \u2014 CFOs, finance managers, executives \u2014 before investing in deep-dive exfiltration.<\/p>\n\n\n\n

Persistence through inbox rules.<\/strong> Malicious inbox rules are created to redirect or hide communications, giving the attacker ongoing visibility into sensitive email threads without the user noticing.<\/p>\n\n\n\n

Device registration.<\/strong> In some cases, attackers registered new devices within 10 minutes of compromise, generating Primary Refresh Tokens for long-term persistent access.<\/p>\n\n\n\n

What This Means for Australian Organisations<\/h2>\n\n\n\n

Australian mid-market organisations face a specific set of risks from this campaign.<\/p>\n\n\n\n

Essential Eight compliance is not enough on its own.<\/strong> The Essential Eight maturity model recommends MFA, and rightly so. But device code phishing demonstrates that MFA alone does not close every authentication gap. Organisations reporting Essential Eight compliance need to assess whether they have addressed authentication flows that bypass traditional MFA protections.<\/p>\n\n\n\n

Microsoft 365 tenants are the primary target.<\/strong> This campaign specifically targets the Microsoft identity platform. Any organisation running Microsoft 365, Azure AD (now Entra ID), or hybrid identity needs to evaluate its exposure to device code authentication abuse.<\/p>\n\n\n\n

Cloud-native infrastructure is being weaponised.<\/strong> The use of Railway.com, Vercel, and Cloudflare Workers means traditional perimeter defences and domain reputation services will miss this traffic. Security teams cannot rely solely on URL filtering to catch these attacks.<\/p>\n\n\n\n

Five Actions to Take Now<\/h2>\n\n\n\n

1. Block Device Code Flow Where It Is Not Needed<\/h3>\n\n\n\n

Microsoft recommends blocking the device code authentication flow using Conditional Access policies. Most organisations do not have legitimate use cases for this flow. If smart TVs and IoT logins are not part of the environment, disable it.<\/p>\n\n\n\n

2. Deploy Phishing-Resistant Authentication<\/h3>\n\n\n\n

Move beyond push-notification MFA toward FIDO2 security keys or Microsoft Authenticator with passkeys. These methods are resistant to session hijack attacks because they are cryptographically bound to the originating device and URL.<\/p>\n\n\n\n

4. Implement Sign-In Risk Policies<\/h3>\n\n\n\n

Conditional Access policies based on sign-in risk can automatically block or require re-authentication when anomalous authentication patterns are detected. This includes device code authentication from unusual IP ranges or unfamiliar locations.<\/p>\n\n\n\n

5. Monitor for Post-Compromise Indicators<\/h3>\n\n\n\n

Security operations teams should hunt for the specific indicators Microsoft has published \u2014 suspicious inbox rule creation, anomalous MailItemsAccessed events via Graph API, and device registrations from unexpected sources. Microsoft Sentinel and Defender XDR both provide detection queries for these activities.<\/p>\n\n\n\n

The Bigger Picture<\/h2>\n\n\n\n

This campaign is a preview of where phishing is heading. AI-generated content, dynamic infrastructure, and abuse of legitimate authentication protocols make traditional defences insufficient on their own.<\/p>\n\n\n\n

Australian organisations need to treat identity security as a layered discipline \u2014 not a single checkbox. MFA remains essential, but it must be paired with Conditional Access policies, authentication flow restrictions, phishing-resistant credentials, and active threat hunting.<\/p>\n\n\n\n

CPI Consulting helps Australian organisations assess and strengthen their Microsoft 365 security posture, including identity protection, Conditional Access design, and threat detection. If this campaign raises questions about your current configuration, our team can help you evaluate your exposure and close the gaps.<\/p>\n\n\n\n