Device Code & OAuth Phishing
Stealing accounts without stealing passwords — Microsoft 365 and Google Workspace
This course is for the person who manages church email, files, and accounts — whether that is a dedicated IT volunteer, an office administrator, or the pastor who ended up with the Microsoft 365 login. No deep technical background required.
Traditional phishing steals your password. The attacks in this course are different: the attacker gets you — or a staff member — to hand over access on a real Microsoft or Google page, so there is no fake website to spot. Multi-factor authentication often does not stop them.
Admin note: The Admin Defenses section covers specific settings in Microsoft 365 / Entra ID and Google Workspace that can block these attacks at the policy level — before any staff member makes a mistake.
Why This Attack is Different
Learn why multi-factor authentication alone does not stop these attacks
- Password phishing vs. token and consent phishing
- Why MFA doesn't always protect you
- Why churches are targeted
- What attackers actually gain
Device Code Phishing
What happens when someone asks staff to type a code on a real Microsoft page
- How device codes are used legitimately
- How attackers exploit the flow
- Church-specific scenarios to watch for
- The one rule that stops it
OAuth Consent Phishing
Understanding the "Allow this app" screen that can hand over your mailbox
- What granting app consent actually does
- How to read a permissions screen
- Fake integrations targeting churches
- User and admin rules for consent
Admin Defenses
Settings to turn on in Microsoft 365 / Entra ID and Google Workspace
- Blocking device code sign-in (M365)
- Restricting user consent and app approvals
- Reviewing app grants and audit logs
- Google Workspace third-party app controls
If It Already Happened
Step-by-step response when an account or app grant is compromised
- Revoking sessions and app consent immediately
- Checking mailbox rules and forwarding
- When a password reset is not enough
- Who to notify in your church
Practice Scenarios
Test your ability to spot device-code and consent phishing in real situations
- Phone call with a device code
- Lookalike app consent screen
- Admin policy decision scenarios
- Spot the red flag exercises