OAuth Device Code Flow Security: How to Detect and Prevent Device Code Phishing
OAuth’s Device Authorization Grant (RFC 8628) was designed for TVs, CLIs, and IoT devices that can’t open a browser. Unfortunately, attackers have turned it into one of the most effective MFA-bypass techniques of 2024–2026, targeting thousands of Microsoft 365 organizations per campaign. This guide explains how the attack works at the protocol level and gives you specific, actionable steps to block it in every major identity platform. How Device Code Phishing Works (Protocol-Level) The Device Authorization Grant flow involves three parties: the device (attacker’s script), the authorization server (Microsoft, your IdP), and the user. Here’s the normal flow — and where attackers hijack it: ...