Device Code Phishing

Device code phishing abuses OAuth 2.0 device authorization by tricking a user into entering an attacker-initiated user_code at the identity provider's legitimate verification_uri. The attacker polls the associated token endpoint and, after the user completes the identity provider's authentication and authorization flow, receives the tokens and permissions granted by that authorization. The flow does not inherently skip password or MFA: the user may complete both on the legitimate sign-in page, while the resulting token belongs to the attacker-initiated transaction. Token types depend on requested scopes; for Microsoft Entra, a refresh_token requires offline_access and an id_token requires openid.