Glossary
What is device code phishing?
Phishing that abuses the device code sign-in flow: the victim types an attacker-generated code into a genuine sign-in page, handing the attacker valid access tokens.
How it works
Microsoft explains that the device code flow lets someone sign in on a device that cannot show an interactive sign-in by entering a code on another device. In device code phishing, the attacker generates a real device code request and tricks the target into entering it on the legitimate sign-in page. The attacker then receives the access and refresh tokens, and keeps access while they stay valid.
A real example
In February 2025 Microsoft reported that the group it tracks as Storm-2372 had run device code phishing since August 2024 against governments, NGOs and many industries. The actor built rapport over WhatsApp, Signal or Microsoft Teams while posing as a prominent person, then sent a fake Teams meeting invitation whose ID was the device code.
How to train for it
- Never enter a code someone sent you on a sign-in page.
- Check which app a sign-in prompt says you are signing in to.
- Be wary when a new contact moves you to a meeting link quickly.
Microsoft recommends blocking device code flow where it is not needed. SecurityRing does not currently list device code phishing as a simulation type.
Sources
Every clause, incident and figure above comes from these official or original sources.
- Microsoft Threat IntelligenceStorm-2372 conducts device code phishing campaignPublished 13 February 2025 · Accessed 17 October 2026.