Does this concern you?
- Affected: companies whose staff sign in with Microsoft 365 (Entra ID) or Google Workspace accounts. According to BleepingComputer, a device-code token can open the user's resources and connected single sign-on apps such as Microsoft 365, Salesforce, Slack or Atlassian.
- Skip it if: your company has no work Microsoft or Google accounts.
What to do
- Find out who uses device code sign-in: in the Microsoft Entra admin center, filter the sign-in logs by authentication protocol for device code flow.
- Block it where nobody needs it, as Microsoft recommends (needs Entra ID P1 or Microsoft 365 Business Premium): Entra ID > Conditional Access > Policies > New policy; all users except your emergency (break-glass) accounts; All resources; Conditions > Authentication Flows > Device code flow; Grant > Block access. Start in Report-only, then switch it On.
- Tell colleagues: a code from a website never goes into a Microsoft sign-in page, and an event that wants a work-account sign-in for a free AI subscription is a red flag.
- Against session hijacking, the Google path's method, BleepingComputer recommends phishing-resistant MFA such as FIDO2 security keys.
- Already hit? Device-code sign-ins by people who never use that flow, as far back as your logs go, are the sign to look for. In our view, revoke that user's sessions, reset the password and check the connected apps.
- Separate case, reported November 2: Microsoft described intrusions where attackers posing as IT support on Teams talked employees into opening Quick Assist. Limit which outside Teams organisations reach staff; confirm surprise support calls through a known internal channel.
What we know – and what we don't
- On the Microsoft path, the victim types the code into Microsoft's genuine device login page and approves the request; Microsoft then issues a token to the attacker's Kali365 session, and MFA does not stop it. A fake VoidProxy login can then collect the password and cookie too.
- On the Google path, VoidProxy proxies Google's real sign-in and captures the password, the MFA response and the session cookie.
- Push Security does not know how the links are spread. They pass through Google and Zapier URL shorteners and behind a Cloudflare CAPTCHA that keeps scanners out. Similar earlier campaigns used Zoom event pages (ANY.RUN) and GoTo Webinar emails (Cofense).
- No report says how many accounts were taken.
- In the Teams intrusions, Microsoft names no attacker and no dates.
Why it matters
Staff learn to check the address bar, and here it really is Microsoft's. The giveaway is a code that came from somewhere else.