---
title: Hackers Exploit Microsoft's Own Login System to Steal M365 Accounts
description: Cybercriminals exploit OAuth device codes to hack Microsoft 365 accounts, using phishing emails and fake logins undetected by security tools.
canonical_url: https://codekeeper.co/ticker/cybercriminals-abuse-oauth-device-codes-in-microsoft-365-attacks
---

# Hackers Exploit Microsoft's Own Login System to Steal M365 Accounts

Cybercriminals exploit OAuth device codes to hack Microsoft 365 accounts, using phishing emails and fake logins undetected by security tools.

![Content Team](https://codekeeper.co/hubfs/_sized/Codekeeper_21_beeldmerkL-800.png)

By Content Team Dec 22, 2025

Share [![Share on facebook](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Facebook.svg)](http://www.facebook.com/share.php?u=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fcybercriminals-abuse-oauth-device-codes-in-microsoft-365-attacks%3Futm_medium%3Dsocial%26utm_source%3Dfacebook) [![Share on linkedin](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Linkedin.svg)](http://www.linkedin.com/shareArticle?mini=true&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fcybercriminals-abuse-oauth-device-codes-in-microsoft-365-attacks%3Futm_medium%3Dsocial%26utm_source%3Dlinkedin) [![Share on twitter](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20X.svg)](https://twitter.com/intent/tweet?original_referer=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fcybercriminals-abuse-oauth-device-codes-in-microsoft-365-attacks%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fcybercriminals-abuse-oauth-device-codes-in-microsoft-365-attacks%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&source=tweetbutton&text=) [![Share on email](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Mail.svg)](mailto:?subject=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Fcybercriminals-abuse-oauth-device-codes-in-microsoft-365-attacks%3Futm_medium%3Dsocial%26utm_source%3Demail%20&body=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Fcybercriminals-abuse-oauth-device-codes-in-microsoft-365-attacks%3Futm_medium%3Dsocial%26utm_source%3Demail) ![Copy link](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Copy.svg)

ON THIS PAGE

### Want more insights like this?

Subscribe to our newsletter to get the latest software protection strategies delivered to your inbox.

By submitting your email, you consent to Codekeeper contacting you and agree to our [privacy policy](https://codekeeper.co/privacy-policy) .

Cybercriminals are using a clever new trick to break into Microsoft 365 accounts by abusing OAuth device codes—a legitimate Microsoft feature meant for smart TVs and similar devices. The scam works by sending phishing emails with fake document links that generate real device codes. Victims then enter these codes on Microsoft's actual login page at microsoft.com/devicelogin, unknowingly handing over account access to hackers. Two main tools are driving these attacks: SquarePhish2 uses QR codes for mass campaigns, while Graphish creates fake login pages that steal both passwords and authentication tokens. By September 2025, these attacks became widespread, targeting everyone from corporate users to government officials. Since the attack uses Microsoft's real authentication system, it's extremely hard to detect with traditional security tools. **Source:** [Cybersecurity News](https://cybersecuritynews.com/hackers-using-phishing-tools/)

Share this article [![Share on facebook](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Facebook.svg)](http://www.facebook.com/share.php?u=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fcybercriminals-abuse-oauth-device-codes-in-microsoft-365-attacks%3Futm_medium%3Dsocial%26utm_source%3Dfacebook) [![Share on linkedin](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Linkedin.svg)](http://www.linkedin.com/shareArticle?mini=true&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fcybercriminals-abuse-oauth-device-codes-in-microsoft-365-attacks%3Futm_medium%3Dsocial%26utm_source%3Dlinkedin) [![Share on twitter](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20X.svg)](https://twitter.com/intent/tweet?original_referer=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fcybercriminals-abuse-oauth-device-codes-in-microsoft-365-attacks%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fcybercriminals-abuse-oauth-device-codes-in-microsoft-365-attacks%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&source=tweetbutton&text=) [![Share on email](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Mail.svg)](mailto:?subject=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Fcybercriminals-abuse-oauth-device-codes-in-microsoft-365-attacks%3Futm_medium%3Dsocial%26utm_source%3Demail%20&body=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Fcybercriminals-abuse-oauth-device-codes-in-microsoft-365-attacks%3Futm_medium%3Dsocial%26utm_source%3Demail) ![Copy link](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Copy.svg)

![blog_book_a_demo_cta_3x](https://codekeeper.co/hubfs/_sized/Codekeeper%202025/blog_book_a_demo_cta_3x-768x512.webp)

Have questions about protecting your software?

Our escrow experts are standing by to help.

[Book a free demo](https://codekeeper.co/book-a-demo)

YOU MAY ALSO LIKE

[Critical JetBrains TeamCity Flaw Lets Attackers Run Commands Without Logging In Aug 11, 2026](https://codekeeper.co/ticker/jetbrains-teamcity-critical-vulnerability-patch)

[Nation-State iPhone Exploit Chains Coruna and DarkSword Are Now in Cybercriminals' Hands Aug 11, 2026](https://codekeeper.co/ticker/darksword-coruna-iphone-exploit-chains)

[CISA Warns of Actively Exploited Zero-Day in Cisco Firewall Management Center Aug 11, 2026](https://codekeeper.co/ticker/cisa-warns-zero-day-flaw-cisco-fmc)

[Cyberattacks Spy Campaign on Ukraine Traced to North Korea-Linked Hackers Oct 14, 2026](https://codekeeper.co/ticker/north-korean-hackers-target-ukraine)