To defend against these sophisticated attacks, cybersecurity professionals should implement conditional access policies that restrict authentication based on device compliance and geographic location, regularly audit OAuth token requests, deploy phishing-resistant MFA solutions using FIDO2 security keys rather than SMS-based verification, and conduct comprehensive security awareness training focusing specifically on these emerging threats. A sophisticated cyber campaign orchestrated by the Russian state-backed group Storm-2372 has emerged, exploiting device code phishing tactics to circumvent Multi-Factor Authentication (MFA) security measures. The device code phishing attack exploits the OAuth 2.0 device authorization grant flow, which was designed to help users authenticate on devices with limited input capabilities. The device code phishing technique weaponizes a legitimate authentication method originally designed to simplify login processes for devices with limited input capabilities. By leveraging actual OAuth device authorization flows, the attackers can bypass traditional phishing detection systems that look for counterfeit login pages. In these attacks, victims receive seemingly authentic phishing messages that direct them to genuine authentication portals, creating a false sense of security while the attackers operate behind the scenes. This targeted approach represents a significant escalation in threat actors’ capabilities to defeat advanced security systems through social engineering, allowing attackers to gain unauthorized access to high-value targets without triggering traditional security alerts. These messages guide targets to actual login pages such as Microsoft’s device code portal, where victims are instructed to enter an attacker-generated code. When implemented legitimately, this flow allows users to authenticate on a separate device and then use a code to authorize access on the original device.
This Cyber News was published on cybersecuritynews.com. Publication date: Thu, 10 Apr 2025 09:45:13 +0000