When checking the URL isn’t enough: a Device Code Phishing attack via a Microsoft website

A sophisticated phishing campaign leveraging the Microsoft Identity Platform's Device Authorization Grant protocol is being used to compromise user accounts. Attackers are crafting emails that appear to be from legitimate sources (like law firms) containing password-protected PDF files. Upon opening the PDF and entering the password, victims are directed to a fake Microsoft login page mimicking the Device Code Flow. This allows attackers to obtain refresh tokens, enabling them to maintain persistent access to user accounts for extended periods, bypassing traditional multi-factor authentication methods.