Device Code Phishing Campaign Targets Microsoft 365: What Businesses Need to Know

By Sentaro Team · Published March 26, 2026

A phishing campaign exploiting OAuth is targeting Microsoft 365 users across several countries. Learn why it matters and how to protect your business.

What Happened

A recent cybersecurity alert has brought to light a device code phishing campaign targeting Microsoft 365 identities. This campaign has impacted over 340 organizations across the United States, Canada, Australia, New Zealand, and Germany. The attackers are exploiting OAuth to deceive users into granting permissions that could compromise their accounts.

Why It Matters

This phishing campaign is significant for several reasons:

• Widespread Impact: With over 340 organizations affected, the scale of this attack is considerable, indicating a sophisticated and well-coordinated effort.
• Exploitation of OAuth: By abusing OAuth, attackers can gain access without requiring direct user credentials, making traditional detection methods less effective.
• Targeting Business Operations: Microsoft 365 is a critical tool for many businesses, and any compromise can lead to operational disruptions, data breaches, and financial losses.

What to Do Next

Businesses can take several steps to protect themselves from this and similar threats:

• Enhance Email Security: Implement advanced email filtering solutions to detect and block phishing attempts before they reach end users.
• Educate Employees: Conduct regular training sessions to raise awareness about phishing tactics and the importance of scrutinizing OAuth permission requests.
• Enable Multi-Factor Authentication (MFA): Require MFA for all accounts to add an extra layer of security beyond just passwords.
• Monitor OAuth Activity: Regularly review and monitor OAuth activity within your organization to detect any unauthorized access attempts.
• Update Security Policies: Regularly update your security policies and incident response plans to ensure they align with current threat landscapes.

Key Takeaways

• Over 340 organizations have been targeted in a sophisticated phishing campaign.
• OAuth abuse allows attackers access without needing direct credentials.
• Implementing MFA and enhancing email security can mitigate risks.
• Ongoing employee education is crucial for phishing prevention.

FAQ

What is OAuth, and how is it being abused?

OAuth is an open standard for access delegation, commonly used for token-based authentication. Attackers abuse it by tricking users into granting permissions, allowing them access without direct credentials.

How can businesses detect OAuth abuse?

Businesses can detect OAuth abuse by monitoring OAuth activity logs, setting up alerts for unusual permission requests, and regularly reviewing third-party app permissions.

Why is multi-factor authentication important?

MFA adds an extra layer of security by requiring a second form of verification, making it harder for attackers to gain unauthorized access even if they have a user's password.

At Sentaro, we understand the critical importance of cybersecurity in today's digital landscape. By staying informed and proactive, you can protect your business from emerging threats. Visit Sentaro for more insights and solutions tailored to your security needs.