AI-powered phishing attacks exploit Microsoft device code login
Attackers used AI-powered phishing platform EvilTokens to conduct device code phishing attacks against enterprises, bypassing multi-factor authentication through social engineering. Separately, fraudsters sent over 100,000 fake ChatGPT payment notification emails to steal credit card data, and impersonated Claude in attacks affecting over 2,000 companies.
What happened
Attackers used the EvilTokens phishing-as-a-service platform to conduct device code phishing attacks against enterprises and organizations, combining AI with automation tools. Hackers sent customized social engineering emails impersonating internal device administrators, claiming meeting room smart TVs or other devices had connection issues and requesting users complete verification by entering device codes generated by the attacker on Microsoft's official login page.
Upon victim completion of multi-factor authentication on the legitimate Microsoft device login page, attackers gained authorization to access the victim's account. Separately, fraudsters sent over 100,000 fake ChatGPT payment confirmation and account verification emails designed to steal credit card and other sensitive financial information, and conducted attacks impersonating Claude affecting over 2,000 companies.
Reported impact
Once the attack succeeded, attackers obtained login credentials and full account control, including access to OneDrive files, Outlook emails and other sensitive data within the compromised account's permissions. Microsoft found that in Azure environments, attackers can obtain high-privilege access tokens through device code phishing, read emails via Microsoft Graph API, access sensitive files, and steal Primary Refresh Tokens through malicious device registration, achieving full account hijacking.
The fake ChatGPT phishing emails posed a major security threat due to their similarity to official notifications. The attacks on Claude affected over 2,000 companies and could result in corporate secrets leakage, internal system compromise, or employee personal information theft.
Index analysis
Security researchers found that Microsoft Azure and Google differ significantly in their OAuth 2.0 device code mechanism permission design. In Azure, attackers can specify resources and Client IDs during the request process, enabling them to obtain high-privilege access tokens; Google enforces stricter permission controls on the device code process, allowing only limited specific authorization scopes, which greatly restricts attackers' ability to gain high-privilege access and lateral movement.
The device code login mechanism, originally designed for devices like smart TVs and IoT devices that lack convenient username and password input, became a new target for hackers due to the attack method's effectiveness. Traditional cybersecurity education emphasizing URL checking cannot effectively prevent this attack type since the entire login and verification process occurs on legitimate Microsoft websites and users encounter no URL or page anomalies.
Governance controls
The National Security Institute of Taiwan and security teams recommended organizations immediately review their cloud environment settings and implement protective measures. Organizations should evaluate whether they genuinely need the device code flow, and if not, use conditional access policies to fully block the functionality; if business needs prevent complete disabling, establish strict whitelists allowing only specific users, trusted devices, or designated IP ranges.
Security teams should strengthen monitoring of login logs for Device Code authentication protocol activity and immediately revoke account authorization and all existing connection sessions upon discovering anomalous login requests or unexpected device code verification. Experts advised that traditional phishing email training is insufficient against these attack patterns, and organizations should strengthen employee awareness of new social engineering attacks, educating users to remain highly alert to any emails or messages requesting device code entry, application authorization, or additional authentication without confirmation.
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.