Surge in OAuth Device Code Phishing Targets M365 Accounts

A significant increase in OAuth device code phishing attacks has been reported, leading to successful takeovers of Microsoft 365 accounts. These attacks grant threat actors full access to accounts, facilitating data theft and ongoing compromises. The rise in such attacks has been noted since September 2025, marking an unusual trend in the exploitation of this technique.