Click-time code generation strips the 15-minute limit out of device code phishing

The flow being abused exists for hardware that cannot display a sign-in page: smart TVs, printers, anything without a usable browser or keyboard ^[7]. Microsoft's own description of the trade-off explains why the attack works. Because authentication is completed on a separate device, the session that initiated the request is not strongly bound to the user's original context, and actors have abused that decoupling to bypass more traditional MFA protections ^[8]. No password changes hands. The user types a short code into a genuine Microsoft page and authorizes somebody else's session ^[14].

Microsoft says device code attacks are typically narrow in scope, and that this campaign showed a higher success rate driven by automation and dynamic code generation ^[2]. That is where the volume comes from. Backend logic sat on automation platforms including Railway.com, where the actors spun up thousands of unique, short-lived polling nodes running Node.js that got past signature-based and pattern-based detection ^[6]. Lures were generated to fit the recipient's job, on RFP, invoice and manufacturing workflow themes ^[4]. Microsoft's researchers wrote that the activity "marks a significant escalation in threat actor sophistication since the Storm-2372 device code phishing campaign observed in February 2025" ^[12]. They tie it to EvilTokens, a phishing-as-a-service toolkit they call a key driver of large-scale device code abuse ^[3].

A code minted before the mail went out spent most of its 15-minute life waiting for someone to open the message ^[2]. Triggering generation at the moment the link is clicked reduces the interval the attacker has to survive to the seconds between the click and the code entry ^[15].

Who takes the loss is visible in the post-compromise pattern. Follow-on activity concentrated on a subset of high-value targets, selected by automated enrichment of public profiles and corporate directories to find people in financial or executive roles ^[9]. Tokens were then used for email exfiltration and persistence through malicious inbox rules that redirected or concealed messages, alongside Microsoft Graph reconnaissance to map organizational structure and permissions ^[10]. Microsoft did not disclose how many accounts were compromised, describing the campaign as widespread and at scale ^[16].

That leaves a scoping question. The legitimate need for this flow is defined by device class, and the classes are ones an estate can enumerate: displays, printers, kiosks, anything that cannot support an interactive login ^[7]. Everyone else in the directory signs in the normal way. Narrowing the flow to the devices and accounts that require it costs whatever inventory work it takes to find them, and for everyone else it removes the page the lure depends on.

There is some warning time here: the GetCredentialType probing that confirms an address is live typically runs 10 to 15 days before the phishing attempt ^[11]. That lead time only helps a tenant that is looking at it. The delivery side was built for the opposite outcome, a multi-stage pipeline designed to bypass traditional email gateways and endpoint security, opening with an attachment or a URL the user chose to click ^[13]. A tenant that leaves the flow open to the whole directory is choosing to catch a code that is only minted after the click has already happened ^[5].