OAuth Device-Code Phishing

The device authorization grant (RFC 8628) lets input-constrained devices — TVs, CLIs — get tokens by showing the user a short code to enter at a verification URL. Attackers weaponize this flow to phish tokens without a fake login page.

How it works

1. The attacker initiates a device-code flow against the real IdP and receives a genuine user_code and verification_uri.
2. They send the victim a message: "enter code ABCD-1234 at microsoft.com/devicelogin."
3. The victim authenticates on the real, legitimate IdP page and approves.
4. The attacker's device polls the token endpoint and receives the victim's access + refresh tokens.

Because every URL the victim sees is the genuine provider, this evades URL-inspection and many phishing filters. It has been actively used against Microsoft 365 tenants.

How to test / detect

Watch for device-code grants from unexpected clients, sign-ins where the device-code flow is used for interactive users, and short windows between code issuance and redemption from disparate geographies.

Impact

Full token theft — including refresh tokens that survive password changes and bypass the perceived protection of MFA at the moment of phishing.

Defenses

• Restrict or disable the device-code flow for users/tenants that don't need it (Conditional Access).
• Bind device flows to managed/compliant devices; alert on anomalous device-code redemptions.
• User education: legitimate apps rarely ask you to type a device code you didn't initiate.