Device Code Phishing

The report describes the rising use of device code phishing, where attackers abuse the OAuth device code flow—intended for browserless devices like TVs and printers—to obtain tokens and access accounts. By prompting victims to enter a displayed code at a legitimate URL on another device, attackers leverage the dual-path authorization process to complete login on the constrained device, effectively bypassing standard authentication workflows.