Two-factor authentication (2FA) has been one of the most secure ways to protect online accounts. It requires a secondary code besides a password. However, in recent times, 2FA has not been a reliable method anymore, as hackers have started exploiting it easily.
Experts advise users to use passkeys instead of 2FA these days, as they are more secure and less prone to hack attempts. Recent reports have shown that 2FA as a security method is undermined.
Russian-linked state sponsored threat actors are now abusing flaws in Microsoft’s 365. Experts from Proofpoint have noticed a surge in Microsoft 365 account takeover cyberattacks, threat actors are exploiting authentication code phishing to compromise Microsoft’s device authorization flow.
They are also launching advanced phishing campaigns that escape 2FA and hack sensitive accounts.
About the attack
The recent series of cyberattacks use device code phishing where hackers lure victims into giving their authentication codes on fake websites that look real. When the code is entered, hackers gain entry to the victim's Microsoft 365 account, escaping the safety of 2FA.
The campaigns started in early 2025. In the beginning, hackers relied primarily on code phishing. By March, they increased their tactics to exploit Oauth authentication workflows, which are largely used for signing into apps and services. The development shows how fast threat actors adapt when security experts find their tricks.
Who is the victim?
The attacks are particularly targeted against high-value sectors that include:
Universities and research institutes
Defense contractors
Energy providers
Government agencies
Telecommunication companies
By targeting these sectors, hackers increase the impact of their attacks for purposes such as disruption, espionage, and financial motives.
The impact
The surge in 2FA code attacks exposes a major gap, no security measure is foolproof. While 2FA is still far stronger than relying on passwords alone, it can be undermined if users are deceived into handing over their codes. This is not a failure of the technology itself, but of human trust and awareness.
A single compromised account can expose sensitive emails, documents, and internal systems. Users are at risk of losing their personal data, financial information, and even identity in these cases.
How to Stay Safe
Verify URLs carefully. Never enter authentication codes on unfamiliar or suspicious websites.
Use phishing-resistant authentication. Hardware security keys (like YubiKeys) or biometric logins are harder to trick.
Enable conditional access policies. Organizations can restrict logins based on location, device, or risk level.
Monitor OAuth activity. Be cautious of unexpected consent requests from apps or services.
Educate users. Awareness training is often the most effective defense against social engineering.
