FBI Warns Microsoft Users—New Attack Gains Access To Accounts

On May 21, the FBI issued a warning about a new AI-powered cyberattack that targets Microsoft 365 users. The attack employs device code phishing to steal OAuth tokens, enabling attackers to bypass multi-factor authentication (MFA) and gain persistent access to accounts.

Device code phishing exploits the device code flow, designed for devices that cannot handle full browser-based authentication. The attacker presents a legitimate-looking login prompt asking users to enter a code, which is then used to obtain OAuth tokens. These tokens allow access without a password or MFA, making the attack particularly dangerous. The AI component likely enhances the campaign's ability to craft convincing prompts and scale the attack.

The FBI's warning underscores the increasing use of AI in cyberattacks and the need for organisations to update their security postures. Recommendations include implementing conditional access policies, using token lifetime limits, and educating users about device code phishing. Microsoft has not yet released an official statement specifically addressing this attack. The warning serves as a reminder that even robust security measures like MFA can be circumvented by evolving threats.