Signal
AI-powered phishing campaign exploits Microsoft OAuth device code flow to compromise hundreds of organizations daily
Evidence first: scan the strongest sources, then decide whether to go deeper.
Published 2026-04-07 11:57 UTCUpdated 2026-04-07 20:19 UTC
rss
phishingoauthaccount_takeoverautomationaimicrosoft_security
Source links open
Source links and full evidence are open here. Archive history, compare-over-time, alerts, exports, API, integrations, and workflow are paid.
No card needed for the free brief.
Evidence trail (top sources)
top sources (2 domains)domains are deduped. counts indicate coverage, not truth.2 top sources shown
limited source diversity in top sources
Overview
A sophisticated phishing campaign leveraging AI and automation abuses Microsoft's OAuth Device Code Authentication flow to bypass standard security measures and compromise organizational accounts at scale.
Entities
Microsoft
Score total
0.99
Momentum 24h
2
Posts
2
Origins
2
Source types
1
Duplicate ratio
0%
Why now
- Campaign is active and compromising hundreds of organizations daily, indicating urgent threat.
- Use of AI and automation marks a new evolution in phishing tactics requiring updated defenses.
- Microsoft OAuth device code flow is widely used, putting many organizations at risk.
Why it matters
- Attack bypasses standard OAuth device code expiration, undermining a common security mechanism.
- AI and automation increase phishing scale and speed, threatening organizational security at large scale.
- Compromise of corporate email and financial data can lead to significant operational and financial damage.
LLM analysis
Topic mix: lowPromo risk: lowSource quality: medium
Recurring claims
- Phishing campaign uses AI and automation to bypass OAuth device code expiration and compromise organizational accounts
- Hundreds of organizations are compromised daily through this Microsoft device code phishing attack
How sources frame it
- Microsoft Defender Security Research Team: neutral
- The Register Security: neutral
This campaign highlights the increasing sophistication of phishing attacks leveraging AI and automation to exploit legitimate authentication flows, emphasizing the need for enhanced detection and response capabilities.
All evidence
All evidence
Hundreds of orgs compromised daily in Microsoft device code phishing attacks
The Register Security · go.theregister.com · 2026-04-07 20:19 UTC
AI-enabled device code phishing campaign exploits OAuth flow for account takeover
Help Net Security · helpnetsecurity.com · 2026-04-07 11:57 UTC
Show filters & breakdown
Posts loaded: 0Publishers: 2Origin domains: 2Duplicates: -
Showing 2 / 0
Top publishers (this list)
- The Register Security (1)
- Help Net Security (1)
Top origin domains (this list)
- go.theregister.com (1)
- helpnetsecurity.com (1)