Device Code Phishing Attacks
Brief
As more organizations move to hardware tokens and password-less auth (e. g. Yubi-keys, Windows Hello for Business,…) attackers will look for other ways to to trick users to gain access to their data.
One novel phishing technique is by using the OAuth2 Device Authorization Grant .
This post describes how it works with Microsoft AAD as example.
Attacker initiates the phishing flow
The attacker starts a Device Code flow by issuing a request to the device code token endpoint (e.g.
login.microsoftonline.com/%7Btenant%7D.onmicrosoft.com/oaut…
).