Surge in Microsoft 365 Account Takeovers via OAuth Device Code Phishing

Proofpoint has reported a significant rise in account takeovers of Microsoft 365 users due to the exploitation of Microsoft's OAuth device code authorization flow. Attackers are using a legitimate login process to trick users into entering one-time codes on Microsoft's authentication portal, allowing unauthorized access to corporate accounts. Both financially motivated criminals and state-aligned groups are employing this technique.