The Attack That Bypasses the Lock
Most security training focuses on one scenario: someone sends a fake email with a link to a fake login page, you type in your password, and the attacker captures it. Multi-factor authentication (MFA) was designed to stop exactly that — and it does, most of the time.
Device code phishing and OAuth consent phishing take a different path. Instead of a fake page, attackers direct your staff to real Microsoft or Google pages — pages that look exactly right because they are the real thing. The victim signs in normally, completes MFA, and still hands control of their account to the attacker.
Multi-factor authentication is essential and should remain enabled. But it was designed to protect the login step — the moment where someone proves they are who they say they are. These attacks skip or work around that step:
- Device code flow: The user proves their identity (including MFA) to get a token. That token goes to the attacker, not to the user's browser. MFA was completed — just on behalf of the wrong party.
- Consent phishing: No login is required at all. The user is already signed in. They only need to click Allow. MFA has nothing to verify.
- Tokens persist: After a successful attack, the attacker holds a token that remains valid even if the victim changes their password. Revoking access requires separate admin action.
Once an attacker has a valid token or app consent, they can access everything that account can access — silently, over time, from anywhere in the world.
Read, send, and delete messages — including resetting passwords for other services that send codes to this inbox
Files and SharePoint / Drive
Download donor lists, financial records, personnel files, and ministry documents
Calendar
See when the office is closed, when staff are traveling, and when buildings are empty
Contacts
Export member and donor contact information
Persistent access
Unlike a stolen password, a token does not expire when the victim logs out or changes their password
Lateral movement
From one account, an attacker may reach shared drives, team channels, or accounts of people who trusted the compromised account