# The Password Reset Is a Placebo
For fifteen years, the security industry sold a simple story: protect the front door and you're safe. Strong passwords, then MFA, then phishing-resistant MFA. The attacker tries the door, finds it locked, moves on.
That story is dead. The attackers figured out they don't need to pick the lock. They wait for you to open it yourself.
## What Device-Code Phishing Actually Does
Device-code authentication was built for a legitimate problem. Smart TVs, industrial controllers, printers — devices that don't have a keyboard handy can't reasonably prompt a user to type their email and password. So Microsoft and Google designed a flow: the device displays a short code, the user goes to a real auth page on their phone or computer, enters the code, and the device gets a token. Clean, usable, legitimate.
Attackers spotted the abuse vector immediately.
The attack is disarmingly simple. The victim gets a phishing email that looks like a Teams invite, a shared document, a calendar update. Inside is a device code and a link to the real Microsoft authentication portal — not a spoofed page, the actual login.microsoft.com. The victim types in the code, Microsoft says "authentication successful," and the attacker's session now holds a valid access token tied to that user's account.
MFA fires. The user approves it. They just authorized an attacker.
This isn't a flaw in MFA. The multi-factor check passed correctly. The problem is that authentication, the moment of identity verification, has been decoupled from authorization — the question of whether this session should be trusted to do anything.
## The Post-Authentication Gap
Security teams have spent a decade hardening login. SIEM rules that trigger on failed auth attempts. Identity providers configured to block suspicious geographies. Conditional access policies that check device posture before issuing tokens.
None of that matters once the token is issued.
"The adversary arrives with valid credentials and a valid session," as ClearVector's CEO John Laliberte put it to Dark Reading. "From the perspective of the application, the adversary looks exactly like the legitimate user."
That sentence deserves to sit with you for a moment. Every detection rule you wrote that triggers on "anomalous authentication" is now partially blind. The attacker passed the authentication check. Your tools saw a clean login and filed it under normal.
Device-code phishing is one vector. But the same problem extends across the identity stack:
The common thread is that none of these require knowing your password. The credential is irrelevant. The token is the prize.
## Why Resetting Passwords Does Nothing
When an attacker holds a valid session token, a password reset is theatrical. The token was issued before the reset. Many identity systems don't invalidate outstanding tokens when credentials change — the design assumption is that tokens are short-lived enough not to matter. In practice, access tokens often live for an hour; refresh tokens can live for days or weeks.
The attacker resets with the token. Then they issue new tokens, add persistence, and exfiltrate before the rotation catches up. Password reset email sent, attacker unaffected, IR team confused.
This is the playbook Scattered Spider used against casino operators in 2023. It's what drove the string of Microsoft 365 compromises attributed to groups like Storm-0867 and related clusters in 2024 and 2025. The pattern isn't new — it's been visible in incident data for three years. What's new is the scale and the fact that the tooling to pull off these attacks is now commoditized. You don't need sophisticated capabilities. You need a phishing kit and a patient approach.
## What the Perimeter-First Model Gets Wrong
Enterprise security architecture is still largely organized around the idea that authenticated equals trusted. The firewall checks IP. The identity provider checks credentials. The application checks whether the user has a valid session. After that, the assumption is that normal business activity can proceed.
That assumption was always imperfect. It is now a known attack surface.
Zero trust as a concept was supposed to fix this — never trust, always verify, check every request. In practice, "zero trust" has often meant "better MFA and network segmentation" rather than continuous behavioral evaluation of authenticated sessions. Vendors sell zero trust architectures that still rely on the initial authentication as the primary trust signal.
Genuine post-authentication visibility means monitoring what authenticated sessions actually do: which APIs they call, what data they touch, whether the behavioral pattern matches the historical baseline for that user, whether the session is operating from expected endpoints. This is behavioral analytics applied after login, not before — and most organizations are not doing it at this resolution.
---
## HackWire Analysis
The timing here matters in a specific way. Identity providers have spent three years pushing phishing-resistant MFA — FIDO2, passkeys, hardware tokens — as the definitive answer to credential phishing. That push is correct and organizations should complete it. But device-code phishing sidesteps passkeys entirely because it doesn't phish the password. It phishes the authorization act itself.
What's missing from most coverage of this trend is the infrastructure angle. The reason session-token theft has accelerated isn't just that attackers got creative — it's that the infostealer ecosystem has industrialized cookie and token harvesting. Malware families like Lumma, Vidar, and Raccoon don't steal passwords as a primary objective anymore. They harvest browser sessions, saved credentials, and OAuth tokens from developer environments and business workstations. That stolen material is sold in bulk on criminal markets. The device-code phishing campaigns are the higher-touch cousin of the same underlying shift.
Defenders who haven't tuned detection to post-authentication behavior are operating with a genuine blind spot. The concrete ask isn't complicated but it is uncomfortable: pull your identity provider logs and look at token issuance patterns, not just authentication failures. Review which applications issue long-lived refresh tokens and whether revocation works correctly when credentials change. Treat session anomaly detection with the same priority you gave login anomaly detection five years ago.
Industries with high-value SSO environments — financial services, healthcare, defense contractors, SaaS vendors with wide OAuth grants — are the most exposed right now. If a single identity provider compromise puts an attacker inside twenty downstream applications with valid sessions, that's not a credential problem. That's a blast radius problem that no password policy addresses.
The front door obsession served us well for a while. The attackers moved to the window.
— HackWire Editorial
---
## Related Coverage