Why This Attack is Different

The Attack That Bypasses the Lock

Most security training focuses on one scenario: someone sends a fake email with a link to a fake login page, you type in your password, and the attacker captures it. Multi-factor authentication (MFA) was designed to stop exactly that — and it does, most of the time.

Device code phishing and OAuth consent phishing take a different path. Instead of a fake page, attackers direct your staff to real Microsoft or Google pages — pages that look exactly right because they are the real thing. The victim signs in normally, completes MFA, and still hands control of their account to the attacker.

Password Phishing vs. Token and Consent Phishing

Why MFA Often Does Not Stop These Attacks

Multi-factor authentication is essential and should remain enabled. But it was designed to protect the login step — the moment where someone proves they are who they say they are. These attacks skip or work around that step:

  • Device code flow: The user proves their identity (including MFA) to get a token. That token goes to the attacker, not to the user's browser. MFA was completed — just on behalf of the wrong party.
  • Consent phishing: No login is required at all. The user is already signed in. They only need to click Allow. MFA has nothing to verify.
  • Tokens persist: After a successful attack, the attacker holds a token that remains valid even if the victim changes their password. Revoking access requires separate admin action.
Why Churches Are Good Targets

What the Attacker Actually Gets

Once an attacker has a valid token or app consent, they can access everything that account can access — silently, over time, from anywhere in the world.

Email

Read, send, and delete messages — including resetting passwords for other services that send codes to this inbox

Files and SharePoint / Drive

Download donor lists, financial records, personnel files, and ministry documents

Calendar

See when the office is closed, when staff are traveling, and when buildings are empty

Contacts

Export member and donor contact information

Persistent access

Unlike a stolen password, a token does not expire when the victim logs out or changes their password

Lateral movement

From one account, an attacker may reach shared drives, team channels, or accounts of people who trusted the compromised account