Microsoft365

OAuth’s Device Authorization Grant (RFC 8628) was designed for TVs, CLIs, and IoT devices that can’t open a browser. Unfortunately, attackers have turned it into one of the most effective MFA-bypass techniques of 2024–2026, targeting thousands of Microsoft 365 organizations per campaign. This guide explains how the attack works at the protocol level and gives you specific, actionable steps to block it in every major identity platform. Clone the companion repo: oauth-device-code-phishing-defense has idempotent, production-ready scripts for every mitigation below — Conditional Access deployment and anomaly scanning for Entra ID, realm/client-level disabling for Keycloak, grant-type removal for Auth0, tuned Sentinel/Splunk detection queries, and a full incident-response playbook script. ...

Why This Matters Now: In October 2023, a new phishing technique called Tycoon 2FA emerged, exploiting OAuth to bypass two-factor authentication (2FA) in Microsoft 365. This threat has become urgent because it targets a critical layer of security that many organizations rely on to protect sensitive data. 🚨 Breaking: Tycoon 2FA uses OAuth-based phishing to bypass 2FA in Microsoft 365. Implement robust OAuth consent policies and monitor OAuth activity immediately. 100+Attacks Reported 24hrsResponse Time Needed Understanding Tycoon 2FA Tycoon 2FA is a sophisticated phishing attack that leverages OAuth, a widely used authorization protocol, to bypass the two-factor authentication mechanism in Microsoft 365. Attackers craft deceptive OAuth consent prompts that appear legitimate to users, tricking them into granting permissions to malicious applications. ...