Device code phishing
Device code phishing abuses the OAuth device authorisation flow: the attacker sends the victim a real sign-in code page, and when the victim enters the code the attacker's session receives the tokens.
How it works
The device code flow exists for TVs and consoles that cannot show a browser. The attacker starts a sign-in, obtains a short user code and asks the victim, by email or chat, to enter it at the official device-login page.
The victim signs in on the genuine provider site, so nothing looks wrong, but the session is granted to the attacker's device.
How to protect yourself
- Only enter a device code that your own device is showing you at that moment.
- Organisations can block the device code flow where it is not needed.