🟠 High | Source: The Hacker News
Device code phishing exploits a legitimate OAuth 2.0 login flow — originally designed for smart TVs and similar devices — to trick users into handing over access tokens without entering credentials in the traditional sense. Attackers have rapidly industrialised this technique, making it effective against organisations using Microsoft 365, Azure AD, and other cloud platforms. Because no password is stolen and MFA is bypassed, it largely evades traditional detection controls.
Security Architect’s Take: Audit your Conditional Access or identity policies to restrict or block the OAuth 2.0 device authorisation grant flow for users who have no legitimate need for it — particularly external-facing identities and privileged accounts. Implement token binding, continuous access evaluation, and alert on device code authentication events from unexpected locations or user agents.
Original advisory: 6 Reasons Why Device Code Phishing is the Fastest-Growing Threat of 2026