Validity of Article on Microsoft Device Code Authentication Threats

Question

Hi Team,

Has anyone evaluated the legitimacy of an article discussing multiple threat actors targeting Microsoft Device Code Authentication? Additionally, what is Microsoft's current stance on this issue? Are there any known fixes or implementations in response to these threats?

The article can be found here: [https://www.volexity.com/blog/2025/02/13/multiple-russian-threat-actors-targeting-microsoft-device-code-authentication/]. Looking forward to feedback from the community.

Thank you

Answer 1

Hello @Surjeet Singh,

Thank you for posting your query on Microsoft Q&A.

On February 14, 2025, Microsoft observed Storm-2372 shifting to using a specific client ID for the Microsoft Authentication Broker in the device code sign-in flow. This client ID enables Storm-2372 to obtain a refresh token, which can then be used to request another token for the device registration service and register an attacker-controlled device within Entra ID. With this refresh token and the newly registered device identity, Storm-2372 can acquire a Primary Refresh Token (PRT) and access an organization’s resources. We have also observed the actor using these connected devices to collect emails.

The Microsoft Threat Intelligence Center has identified an active and successful device code phishing campaign by Storm-2372, which has been ongoing since August 2024. The actor has been creating phishing lures that resemble legitimate messaging apps, including WhatsApp, Signal, and Microsoft Teams.

To help organizations mitigate and protect against this threat, we are sharing our latest research, detections, and mitigation guidance. Our goal is to raise awareness of the tactics, techniques, and procedures (TTPs) used in this campaign, educate organizations on how to harden their security posture, and disrupt future threat activity.

For detailed mitigation and protection guidance, please refer to the following document:

Storm-2372 Conducts Device Code Phishing Campaign

I hope this information is helpful. Please feel free to reach out if you have any further questions.

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".

Answer 2

You can block the device code flow via Conditional access policies: https://learn.microsoft.com/en-us/entra/identity/conditional-access/policy-block-authentication-flows#device-code-flow-policies