In three of these campaigns, the common point was abuse of Microsoft's Device Code Authentication, a method by which an attacker, by deceiving the user, can gain access to their Microsoft 365 account without stealing a password and even while directly bypassing MFA.

A allegation by the post, said on 2026-11-06. Statements are as reported by the cited publishers — not verified by DecisionGateway.

نکته مشترک در سه مورد از این کمپینها، سوءاستفاده از قابلیت Device Code Authentication مایکروسافت بود؛ روشی که مهاجم با فریب کاربر میتواند بدون سرقت گذرواژه و حتی دور زدن مستقیم MFA، به حساب Microsoft 365 او دسترسی پیدا کند.