Device Code Phishing: When Doing Everything Right Goes Wrong

Device Code Phishing: When Doing Everything Right Goes Wrong

•

Episode description

Device Code Phishing: When Doing Everything Right Goes Wrong

Microsoft 365 users endured widespread outages this week, and attackers are already preparing to exploit the chaos. KnowBe4’s latest phishing report reveals a troubling evolution: criminals have stopped building fake websites and started borrowing real ones. In this episode, Noel Bradford dissects volume eight of the Phishing Threat Trends Report, examining device code flow attacks where victims check the URL, complete their MFA, sign in on legitimate Microsoft pages, and still hand over account access. He questions the report’s statistical claims, offers KnowBe4 a right of reply, and provides five practical Monday-morning actions for blocking these attacks before they become widespread. The old security advice centred on inspecting web addresses. The web address is now the one honest element in the attack. It’s time to teach your team better questions.

Chapters

  • Welcome Noel introduces the episode against the backdrop of this week’s Microsoft 365 outages. He previews his assessment of KnowBe4’s October 2026 Phishing Threat Trends Report: one valuable insight, questionable statistics, and a product pitch. KnowBe4 receives an open invitation to respond.
  • The Idea That’s Right Attackers have abandoned fake websites in favour of borrowing legitimate ones. Device code flow attacks exploit a Microsoft authentication feature designed for devices without keyboards. Victims check the URL (it’s genuine Microsoft), complete MFA, and unknowingly grant access to an attacker’s device. OAuth consent phishing works similarly: malicious apps receive standing permissions that survive password resets. KnowBe4’s data suggests device code attacks represent two per cent of toolkit-driven phishing, but the door should be closed before that percentage rises.
  • The Awkward Bit KnowBe4 built its reputation on security awareness training, yet this report acknowledges that victims of device code attacks did everything correctly. The training worked, the attacker succeeded anyway, and the document concludes by promoting KnowBe4’s email filtering product. The lesson for defenders shifts from inspecting web addresses to asking a new question: did I initiate this sign-in request?
  • The Numbers I Wouldn’t Repeat The report claims a 60.7 per cent likelihood of attack following major UK news coverage, but provides no time window, attack definition, baseline comparison, or methodology. Without these details, the statistic cannot be independently verified. The underlying behaviour (criminals exploiting breaking news) is plausible and supported by examples, but the percentages lack rigour. This week’s Microsoft outages create ideal conditions for device code attacks disguised as account restoration messages. Noel invites KnowBe4 to publish the methodology behind its figures.
  • Monday Morning Five immediate actions: ask your IT provider whether device code flow is blocked via Conditional Access; confirm who can approve new app permissions; enable the admin consent workflow; audit existing app permissions quarterly; update incident response plans to include revoking sessions and checking app permissions alongside password resets. Staff should be warned that legitimate sign-in pages can be weaponised, and that post-outage restoration never requires typing codes sent by others.
  • Outro Noel summarises the report’s value and limitations, directs listeners to Microsoft guidance in the show notes, and encourages sharing the episode with IT providers. He closes by reframing the security question: Dave did everything right, so we need to give him better questions to ask.

Links