The Phish Did Not Steal the Password. It Rented the Protocol.

Device-code phishing is becoming a subscription business built on legitimate identity infrastructure. The attacker does not need to steal a password or defeat MFA in the familiar sense. The victim authenticates to Microsoft, enters a code, and authorizes an attacker-initiated session through a protocol the tenant still permits.

That creates an uncomfortable defender tension: teams can block yesterday's lure while tomorrow's kit rotates through a new domain, serverless worker, or compromised site. The practical payoff is a better control strategy. Treat page detection as a reach-reduction layer, but make device-code eligibility, exception governance, and post-authentication correlation the durable center of defense.

TL;DR

• Microsoft observed device-code phishing campaigns using dynamic code generation, reputable cloud and serverless infrastructure, AI-assisted lures, Graph reconnaissance, and inbox-rule persistence.
• The FBI described Kali365 as a subscription phishing-as-a-service operation offering lure generation, templates, dashboards, and OAuth-token capture.
• The game changes when attackers can repeatedly productize a legitimate authentication flow. Blocking domains raises campaign cost; constraining the flow can remove whole classes of users from the market.
• Device-code abuse does not prove MFA is useless. It shows that a valid authentication ceremony can still authorize the wrong session.
• Defenders should block the flow by default where practical, govern exceptions as expiring risk decisions, and correlate device-code activity with identity and Microsoft 365 behavior.

The game in one line

PhaaS operators win by increasing lure reach and victim conversion against tenants that remain eligible for device-code access. Defenders change the payoff by reducing that eligibility before the victim ever sees the lure.

The analyst call

• Question: Has device-code phishing crossed from an isolated technique into a repeatable identity-access product?
• Current answer: Yes—but productized does not mean dominant. A named subscription service and observed campaign automation establish a real market offering; public reporting does not establish its share of Microsoft 365 phishing.
• Evidence status: Observed dynamic code generation, cloud and serverless infrastructure, tenant reconnaissance, inbox-rule persistence, and a subscription PhaaS offering.
• Confidence: High that the flow has been productized; moderate that it will remain a durable criminal service line; low on prevalence relative to AiTM, session theft, and other identity attacks.
• Tracking horizon: Over the next 6–12 months, the call strengthens if more kits advertise device-code capture as a standard module. It weakens if provider defaults sharply reduce eligible tenants or PhaaS operators pivot away from the flow.

The key judgment

The weak read is: “AI made phishing pages better.”

The stronger read is: phishing-as-a-service operators are industrializing a legitimate authorization flow, then packaging the surrounding work—lures, redirects, token capture, tenant reconnaissance, and persistence—as a repeatable product.

That matters because the most durable defensive choke point is not the page. It is whether the targeted user and resource can produce useful access through the device-code flow at all.

This does not make email, browser, URL, or hosting controls irrelevant. Those controls reduce the probability that a lure reaches and persuades a target. But infrastructure can rotate faster than many blocklists and investigations. A Conditional Access policy can reduce eligibility across lures that defenders have never seen.

How the protocol becomes inventory

OAuth device authorization exists for legitimate devices and clients that cannot easily accept keyboard input or launch a conventional browser flow. A client requests a device code. The user visits a legitimate verification page, enters the code, authenticates, and authorizes the client session.

In the abusive version, the attacker initiates the session and persuades the victim to complete the ceremony. The user may see a genuine Microsoft domain and a normal MFA prompt. The security failure is not necessarily forged authentication. The outcome is misplaced authorization: the ceremony grants access to a client the attacker initiated.

For a subscription operator, that flow becomes inventory. The service can bundle:

• lure templates and AI-assisted personalization;
• dynamic code generation at click time;
• redirects through compromised domains or reputable serverless platforms;
• token capture and tenant validation;
• automated Graph reconnaissance;
• mailbox-rule or forwarding persistence;
• dashboards that let affiliates run campaigns without building the machinery.

The protocol is legitimate. The operator rents the workflow around it.

The players and their incentives

PhaaS operators

They want a repeatable product that affiliates can buy, learn quickly, and use at scale. Dynamic codes, reusable templates, cloud deployment, and automated post-compromise actions make the service more valuable. Every tenant that broadly permits device-code access expands the addressable market.

Criminal affiliates

They want fast Microsoft 365 access for business email compromise, reconnaissance, data theft, follow-on phishing, or persistence. They do not need novel malware if a subscription kit can deliver valid tokens and useful tenant context.

Identity and cloud providers

They must reduce abuse without breaking legitimate devices, command-line tools, operational workflows, and accessibility use cases. A universal block is simple for defenders but costly where real dependencies remain.

Enterprise defenders

They want to shrink exposure without surprising users or breaking production. That creates pressure to use broad exclusions, permanent exceptions, or report-only policies that never graduate to enforcement.

The attacker benefits when legitimate complexity becomes permanent permission.

The paywall tear line

The public lesson is straightforward: a phishing page is one delivery path, but device-code eligibility is the market the kit depends on.

Below the line, we map the payoff equation, the likely attacker countermoves, the telemetry that separates benign use from abuse, and a rollout plan that gives defenders leverage without pretending every tenant can flip one switch safely.

We also include the technical deep dive report.

The payoff equation

A simple model helps explain why flow policy can be more durable than chasing infrastructure.