How MFA Bypass Works: Not Password Theft, but Obtaining an Official “Entry Key” from the User
New research reveals a sophisticated phishing campaign that successfully bypasses Multi-Factor Authentication (MFA) mechanisms in Microsoft 365 environments. Unlike past attacks that attempted to “fish” for your password, here attackers trick users into approving a malicious device as an authorized one. They achieve this by exploiting a legitimate mechanism (OAuth Device Code), originally designed to connect smart devices to an account.
How does it work?
The victim receives a credible-looking email (concerning a payment, a voice message, or a payslip). The email includes a confirmation code and a link leading to the genuine Microsoft login page. The savvy user checks the URL, sees it is legitimate, and enters the code—but by doing so, they are actually authorizing a device pre-registered by the hacker. At this moment, an “Access Token” is generated, granting the attacker free access to Outlook, Teams, and OneDrive without needing to enter a password or an additional authentication code in the future.
Why is this more dangerous than standard phishing? When MFA works—but is simply not enough
The concerning innovation here is that the user does not land on a fake site, but on the official, secure site of the service provider. Consequently, even experienced employees who have undergone awareness training do not always identify the trap. Once the attacker has obtained the “Access Token,” they effectively become the master of the account and can act on behalf of the user undisturbed.
Experts note that such attacks are a direct response by hackers to the strengthening of corporate defenses. While companies have invested heavily in protecting human access (MFA), they have left an “open door” in the management of integrations and automated connections between systems—and that is exactly where attackers are operating.
The New Structural Flaw: App Integrations
The real threat hides within SaaS connections
Attackers exploit the fact that most organizations connect dozens of external applications to their workspace, often with overly broad permissions. Even after the business need for a specific connection ends, its access remains active—and its “Access Tokens” continue to provide free entry to corporate data. In such a scenario, even a robust MFA setup will not prevent access if a token was obtained fraudulently. Therefore, there is a need for management and monitoring of system connections with the same level of rigor applied to human users.
Recommendations from IPV Security Cybersecurity Experts:
* Restrict Permissions: Allow only pre-approved applications to connect to organizational systems (Allowlist).
* Block Unnecessary Device Connections: Consider disabling or limiting the ability to connect devices via code (Device Code Flow) if there is no real business need for it.
* Connection Mapping: Perform periodic scans of all external applications connected to your email and cloud storage.
* Refresh Permissions: Revoke access for applications or connections that are not in active use.
* Updated Training: Explain to employees that even an official and familiar login page can be part of a trap, and that confirmation codes received via email should not be entered without prior coordination.
In Conclusion
This new attack proves that the battle between hackers and organizations is escalating: instead of trying to break defense mechanisms, attackers simply exploit the system’s legitimate workflow. Multi-Factor Authentication (MFA) is still an essential tool, but it is not a complete solution if application access and external connections are not managed. For CISOs, the message is clear: security does not end with a password. Tight supervision of all “data pipelines” and automated connections in the organization is required—otherwise, your strongest defense could become the silent entry point for the next attacker.
For further information: New phishing campaign tricks employees into bypassing Microsoft 365 MFA – Computerworld
Interested in phishing simulations and a variety of lectures to raise organizational awareness of cyber events? Contact the experts at IPV Security! For professional consultation, contact us at info@ipvsecurity.com or via telephone at 077-4447130.
IPV Security has specialized for 21 years in information security, cyber, risk assessments, and standards and regulations regarding information security and more.