Phishing explained
What is device code phishing?
Device code phishing is an attack in which someone is persuaded to type a short code into a genuine sign-in page. The code belongs to a sign-in the attacker started, so the person approves the attacker's session and the attacker gets access to their account without a fake website or a stolen password.
Last updated
How a device code phishing attack works
- The attacker starts a sign-in on their own device and receives a short code.
- They send the code to the target with a believable reason: a shared document, a meeting invitation, an IT request.
- The target opens the genuine sign-in page, types the code and completes multi-factor authentication.
- The attacker's device is now signed in as the target, often for long enough to read mail and files.
Why it works
Every page the person sees is genuine, so link-checking advice does not help, and multi-factor authentication is completed by the person themselves. Microsoft Threat Intelligence has reported campaigns using this method, including Storm-2372 in February 2025. Read Microsoft's report on Storm-2372.
How to defend against it
- Block the device code flow with Conditional Access, with named exceptions. Microsoft documents this in Conditional Access: authentication flows.
- Review sign-in logs for device code sign-ins.
- Train staff never to enter a code they did not request.
- Watch for risky sign-ins and new sessions across every tenant.
For a step-by-step Conditional Access walkthrough, see ThreeShield's guide to blocking device code flow.
How Lavawall® helps
Lavawall security awareness training teaches staff to recognise sign-in lures, and Lavawall Microsoft 365 breach detection watches for risky sign-ins and account takeover across every tenant you manage.
Frequently asked questions
What is device code phishing?
Device code phishing is an attack in which someone is persuaded to type a short code into a genuine sign-in page. The code belongs to a sign-in the attacker started, so the person approves the attacker's session and the attacker gets access to their account without a fake website or a stolen password.
Why doesn't multi-factor authentication stop device code phishing?
Because the person completes multi-factor authentication themselves, on the real sign-in page. The attacker receives the resulting session, not the password.
How do I block device code phishing in Microsoft 365?
Use a Conditional Access policy that blocks the device code flow for everyone except the few devices and accounts that truly need it, and review sign-in logs for device code sign-ins. Microsoft documents this under Conditional Access authentication flows.
Who legitimately uses the device code flow?
Devices without a normal keyboard or browser, such as some meeting-room systems, and some command-line tools. Allow them by exception rather than leaving the flow open to everyone.
How do I train staff about device code phishing?
Teach one rule: never type a code into a sign-in page unless you started that sign-in yourself on a device in front of you. Lavawall security awareness training covers phishing and account-takeover lures in the Training & Phishing plan.
How does Lavawall help with device code phishing?
Lavawall security awareness training teaches staff to recognise sign-in lures, and Lavawall Microsoft 365 breach detection watches for risky sign-ins and account takeover across every tenant you manage.