Ai-Powered Phishing Campaign Bypasses Mfa, Compromises Hundreds Of Orgs Daily

@Microsoft warned that a large-scale device-code phishing campaign has been compromising hundreds of organizations daily since March 15, using AI-generated lures and automation at nearly every stage. The attackers bypass multi-factor authentication by exploiting OAuth 2.0 device code flows, stealing live access tokens that grant full account access.

Microsoft VP of security research Tanmay Ganacharya said 10 to 15 distinct campaigns launch every 24 hours with highly varied payloads. The tooling shares similarities with EvilTokens, a phishing-as-a-service kit sold since mid-February that promises to extend to Gmail and Okta. Post-compromise activity focuses on finance-related accounts, with automated email exfiltration targeting payroll and invoice data.

The campaign uses dynamic device code generation at the final redirect stage, giving victims a full 15-minute window to complete the phish rather than a shrinking one. Microsoft recommends blocking device code authentication flows wherever possible.