MFA bypass attacks: how Device Code phishing steals sessions

Key Takeaways

• Device Code phishing lets attackers obtain persistent access without stealing credentials or triggering MFA alerts
• Traditional email defenses and credential monitoring often miss session token theft attacks
• Behavioral AI can detect unusual account activity that conventional security controls overlook

Multi-factor authentication remains one of the most recommended security controls, yet attackers have found ways around it. Device Code phishing exploits legitimate Microsoft authentication workflows, letting attackers gain persistent access to corporate accounts without stealing a single password. BleepingComputer will host a webinar on July 8, 2026, examining these techniques and how behavioral AI can detect what traditional defenses miss.

The webinar, titled "Stop chasing alerts: Automating email security with behavioral AI," features Dan Nickolaisen from Abnormal AI and Eric Danneker of Novant Health's Cyber Vigilance team. It targets security professionals dealing with a frustrating reality: their MFA deployments work exactly as designed, yet accounts still get compromised.

How Device Code phishing defeats MFA

The attack works by tricking users into completing a legitimate Microsoft authentication flow on behalf of the attacker. The user sees a real Microsoft login page, enters their real credentials, completes a real MFA challenge. Nothing appears suspicious. But the session token generated by that authentication goes to the attacker's device, not the user's.

This matters because session tokens grant ongoing access to email, cloud applications, and corporate resources. The attacker never needs to bypass MFA because the victim did the authentication for them. Traditional security controls looking for stolen credentials or brute-force attempts see nothing unusual.

FBI data shows business email compromise cost organizations $2.9 billion in 2023 alone. That figure explains why attackers invest effort in sophisticated techniques. The payoff is substantial, and session token theft provides access that persists far longer than a phished password would.

Why traditional email security fails here

Conventional email security tools focus on known malicious indicators: suspicious URLs, attachment types, sender reputation. Credential monitoring watches for leaked passwords on dark web forums. MFA protections assume attackers need the second factor. None of these controls address an attack where the user completes legitimate authentication on a legitimate Microsoft page.

Security teams often discover compromises only after damage occurs. An account sends unusual emails. Cloud storage shows unexpected access patterns. By then, attackers may have already exfiltrated data or initiated wire transfers. The investigation workload falls on already-stretched SOC analysts piecing together what happened.

What behavioral AI detects that rules miss

Abnormal AI's approach, which the webinar will detail, monitors account activity patterns rather than known attack signatures. An account suddenly accessed from an unusual location. Email forwarding rules created unexpectedly. Messages sent to contacts the user has never emailed before. These behavioral signals can indicate compromise even when the initial access appeared legitimate.

The company claims this approach reduces investigation workloads by automating the correlation of suspicious signals. Instead of analysts manually connecting dots across email logs, cloud access records, and authentication events, the system surfaces accounts exhibiting multiple anomalies for prioritized review.

The webinar promises to cover practical detection strategies, not just vendor pitches. Topics include how SOC teams can identify Device Code phishing attempts, what behavioral indicators suggest account takeover, and how automation can compress response times when compromises occur.

The broader shift in phishing tactics

Device Code phishing represents a larger trend. Attackers increasingly target authentication workflows rather than credentials. Adversary-in-the-middle (AiTM) tools like Evilginx and Modlishka intercept sessions in real time. Industry reports suggest AiTM attacks increased over 1,000% between 2022 and 2023.

The shift demands a corresponding change in defense thinking. MFA remains valuable because it blocks the vast majority of opportunistic attacks. But organizations handling sensitive data or high-value transactions need additional detection layers. Assuming MFA handles account security creates blind spots sophisticated attackers exploit.

What the July 8 webinar covers

• How Device Code phishing works and why it bypasses credential theft protections
• Why modern phishing and BEC attacks evade conventional email security
• Operational challenges these attacks create for SOC teams
• How behavioral AI identifies suspicious account activity
• Practical approaches for reducing response times

Registration is open through BleepingComputer's website. The live session runs July 8, 2026.

Frequently Asked Questions

Can MFA be bypassed without stealing the password?

Yes. Attacks like Device Code phishing trick users into completing legitimate authentication flows that deliver session tokens to attackers. The user completes real MFA, but the resulting access goes to the wrong party.

What is Device Code phishing?

Device Code phishing abuses Microsoft's device authorization flow, originally designed for devices without keyboards. Attackers trick users into entering a code on a legitimate Microsoft page, which authorizes the attacker's device to access the victim's account.

How can organizations detect session token theft?

Behavioral analysis that monitors for unusual account activity, such as access from new locations, unexpected email forwarding rules, or communication with unfamiliar contacts, can identify compromises even when the initial access appeared legitimate.

Is MFA still worth implementing?

Absolutely. MFA blocks the overwhelming majority of account takeover attempts. But it shouldn't be the only layer of account protection, especially for organizations handling sensitive data or financial transactions.

Source: BleepingComputer