Device code phishing

OAuth supports multiple different authentication flows that can be used to grant access to an app. One of these is the device authorization grant, which is intended for use with input-constrained devices, such as smart TVs and printers.

This flow operates by supplying a user with a unique code and instructing them to visit a webpage in a browser on a different device to enter the code in order to authorize the device.

This can be used by an adversary to conduct a phishing attack against a target by convincing them to visit their authentication provider website and enter a code supplied by the adversary, thereby granting access to their account.

This shares similar advantages to a consent phishing attack in that it allows access to a target's account without requiring their password or MFA tokens.

It also has other advantages in that the link the target needs to visit is a legitimate URL and there is no prompt to consent to explicit permissions beyond entering the device code and signing in. Additionally, verified apps can be impersonated in some cases.