A new attack method bypasses MFA and uses Microsoft’s own login system against you. Every business owner using Microsoft 365 needs to read this.
Most small business owners believe that a strong password and multi-factor authentication make their Microsoft 365 accounts secure. That assumption is now being exploited at scale. Attackers are targeting Microsoft 365 users with device code authorization phishing – a technique that fools users into approving access tokens, bypassing multi-factor authentication protection entirely.
Campaigns using this method have surged since September 2025, representing a significant shift from limited, targeted attacks to widespread exploitation. Both organized criminal groups and nation-state actors are now using it. If your business runs on Microsoft 365, and most do, you need to act.
How the Attack Works
Microsoft has a login feature designed for devices like smart TVs and printers that can’t display a normal login screen. Instead of typing credentials on the device, a user visits a Microsoft page on their phone or computer and enters a short code. It’s a legitimate, trusted system.
Attackers exploit that trust. They initiate the device login flow themselves, then send your employee an email designed to get them to visit Microsoft’s real login page and enter the code – completing the attacker’s authentication instead of their own.
Your employee does everything right. They visit a real Microsoft website. They complete their MFA. They never hand over their password. And the attacker now has full access to your Microsoft 365 environment.
Action Steps for Your Business
Take these steps now with your IT team or provider:
- Block device code flow in Microsoft Entra Conditional Access. This is the strongest mitigation available and can be deployed in report-only mode first to assess impact before full rollout. Most small businesses don’t use this feature and have no reason to leave it enabled.
- Audit your Microsoft 365 OAuth app permissions. Review which third-party applications have access to your tenant and remove anything unauthorized.
- Train your team on this specific attack. Standard phishing training won’t cover it. The key message is simple: if you receive a request to enter a code on a Microsoft login page that you didn’t initiate, stop and report it.
- Review sign-in logs for your Microsoft 365 accounts. Unusual locations, unfamiliar devices, and off-hours logins are indicators of compromise.
- Check for email forwarding rules set up without your knowledge. This is a common post-compromise action attackers use to quietly collect your outgoing email.
- Review your cyber liability coverage. Confirm that account takeover scenarios are covered and understand what your response obligations are.
Q&A: What Your Clients or Partners May Ask
“How did this happen if you had MFA turned on?”
This attack bypasses both traditional credential theft defenses and multi-factor authentication controls. MFA was never designed to protect against this type of authentication abuse.
“Could my information have been accessed?”
If a business email account is compromised, any data in that account – client correspondence, contracts, financial information – is potentially accessible to the attacker.
“Is this being fixed by Microsoft?”
Microsoft has released tools to block it, but those tools require configuration. Microsoft has been rolling out a managed Conditional Access policy aimed at blocking device code flow authentication, but it requires an administrator to enable and configure it. It doesn’t happen automatically.
“Should I be worried about my own accounts?”
If you share Microsoft 365 services with a vendor or partner whose account is compromised, there’s risk of lateral movement. Security is a supply chain concern, not just an internal one.
How Farmhouse Networking Can Help
Farmhouse Networking reviews and configures Microsoft Entra Conditional Access policies to block device code phishing, audits your Microsoft 365 environment for existing unauthorized access, trains your staff on this and other current attack types, and monitors your accounts ongoing. We work with small and mid-sized businesses across Oregon, Northern California, and New Mexico – and we explain everything in plain language without the IT jargon.
Take the Next Step
Email support@farmhousenetworking.com today and ask for a Microsoft 365 security review. We’ll tell you whether this attack vector is currently open in your environment and what it takes to close it.