This article examines how Device Code Phishing exploits the OAuth 2.0 authentication process used by Microsoft and Google. It details the mechanics of the attack, illustrating how attackers can trick users into providing access tokens through a seemingly legitimate flow. The comparison highlights the different security postures of the two identity providers.

Microsoft is suing RedVDS, a service providing virtual desktops used for phishing and fraud. The company aims to shut down the operation, which has contributed to over $40 million in fraud losses in the US, and has partnered with law enforcement to seize its infrastructure. Victims of RedVDS include various organizations across multiple sectors globally.

Hackers are employing a sophisticated phishing technique that leverages legitimate Microsoft links and Active Directory Federation Services (ADFS) to redirect users to a counterfeit site designed to steal Microsoft 365 logins. By utilizing a trusted domain for redirection, attackers can bypass standard security measures, including multi-factor authentication. Researchers recommend monitoring for ADFS redirects and scrutinizing Google ads for potential malicious links.

A new phishing method called 'CoPhish' exploits Microsoft Copilot Studio agents to issue fraudulent OAuth consent requests, allowing attackers to steal session tokens through social engineering tactics. Researchers from Datadog Security Labs have highlighted the risks associated with Copilot Studio's flexibility and noted that Microsoft plans to address these vulnerabilities in future updates. Users are advised to limit administrative privileges and enforce stricter governance policies to mitigate the risks.

Microsoft and Cloudflare have collaborated to take down the Raccoon365 phishing service, which targeted Microsoft 365 users. This operation aimed to protect users from credential theft and enhance overall cybersecurity measures against such phishing threats. The dismantling of Raccoon365 marks a significant step in combating cybercrime related to phishing schemes.

Microsoft is expanding the list of blocked attachments in Outlook Web and the new Outlook for Windows by adding .library-ms and .search-ms file types starting in July 2025. This decision aims to enhance security by preventing the exploitation of these file types in phishing attacks, although most organizations are unlikely to be affected. Users who need to send or receive these attachments can adjust their settings accordingly.