Device Code Phishing

Device code phishing is a social engineering attack that abuses the OAuth device authorization flow — the login method built for input-constrained devices like smart TVs and conference room hardware. The attacker generates a legitimate device code, then persuades the victim to visit the provider's real sign-in page and enter that code. When the victim authenticates, the identity provider issues access and refresh tokens to the attacker's session, granting account access without a stolen password and often without triggering a second MFA challenge.

How it works

The attacker starts the device login flow with the identity provider and receives a short user code. They then deliver it with a plausible pretext — a fake Microsoft Teams meeting invite, a "device registration" request from IT, a message from a compromised colleague account — instructing the target to go to the provider's genuine verification page and type in the code. Everything the victim sees is authentic: the real domain, a valid certificate, the familiar login screen, their normal MFA prompt. That is what makes the technique effective — there is no fake page to spot. Once the victim completes sign-in, the attacker's client receives the tokens and can read mail, harvest data, and move laterally; Microsoft Threat Intelligence documented exactly this playbook in the Storm-2372 campaigns reported in February 2025, which targeted governments and enterprises through messaging-app lures. Because tokens can be refreshed, access persists until they are revoked.

How to defend against it

Technical controls come first: block or restrict the device code flow with conditional access policies where it is not genuinely needed, limit token lifetimes, and revoke refresh tokens on suspected compromise. Monitor for device-code sign-ins from unusual locations or clients. On the human side, train employees on the rule the attack violates: a login code should only ever originate from a screen in front of you — anyone sending you a code to enter is taking over your session, a cousin of the MFA bypass and consent phishing playbooks. Rehearse the scenario in phishing simulations that use chat and calendar lures, not just email, and see our guide to vishing and smishing attacks for defending the messaging channels these lures arrive through.