Device Code Phishing – Add Your Own Sign-In Methods on Entra ID

TL;DR An attacker is able to register new security keys (FIDO) or other authentication methods (TOTP, Email, Phone etc.) after a successful device code phishing attack. This allows an attacker to backdoor the account (FIDO) or perform the self-service password reset for the account with the newly registered sign-in methods. Microsoft deemed this not a vulnerability.

account attack attacker authentication authentication methods backdoor code device email entra entra id etc fido keys microsoft microsoft azure own password password reset phishing phishing attack phone red teaming register research reset security security keys service sign tools totp vulnerability