Device Code Phishing: OAuth 2.0 Attacks in Google & Azure

What it is

A Huntress case study on device code phishing, an abuse of OAuth 2.0's device authorization grant (RFC 8628), compared across Microsoft/Azure and Google identity providers. The fetched text covers the mechanism and the Azure attack in detail; the Google comparison and any detection/mitigation guidance fall after where the capture cuts off.

How it works

The device code flow legitimately authenticates input-constrained devices (IoT, smart TVs): the device requests a code, the user enters it plus their credentials in a browser on a normal computer, and the device then retrieves the resulting token. The attack co-opts this:

sequenceDiagram
    participant A as Attacker
    participant IdP as Identity Provider API
    participant V as Victim
    A->>IdP: Request device code (no auth required)
    IdP-->>A: device_code + user_code
    A->>V: Phish: "enter this code at the login page"
    V->>IdP: Enters code + username + password + MFA
    Note over V: Victim sees "nothing happens"
    loop every 10s
        A->>IdP: "Authenticated yet?"
    end
    IdP-->>A: Access tokens
    A->>A: Pivot to initial access

The key points from the page: requesting the initial device code requires no authentication — a correctly formatted cURL to the provider's device code endpoint returns the code. The victim signs in on the completely legitimate provider login page (https://microsoft.com/devicelogin), so the phish leads to a real, trusted URL — and MFA does not stop it, because the attacker never handles credentials, only the resulting token. For Azure the cURL specifies a client_id (the requesting client's GUID — flagged as important later) and a resource (e.g. Graph API).

Preconditions / Affected

The tenant/identity provider must permit the device code flow. The attack turns on social engineering: the victim must be convinced to enter the attacker's code and complete sign-in, including MFA.

Caveats

The captured text ends mid-Azure-example — before the Google comparison and before any detection or mitigation content. The client_id significance is teased but not shown here. If you need the defensive guidance or the Azure-vs-Google contrast that is the article's stated payoff, open the page; this capture does not contain it.