OAuth Device Code Phishing: Azure vs. Google Compared

This report examines 'device code' OAuth 2.0 phishing: an attacker requests a device code from an identity provider, tricks a user into entering the code on a legitimate login page, and polls the provider to retrieve the resulting access/refresh tokens. The author shows concrete Azure examples (cURL, token polling) and explains how Microsoft’s permissive client IDs and resource scoping enable powerful post-phish primitives—up to stealing Primary Refresh Tokens—whereas Google’s device-code implementation restricts scopes (Drive/YouTube) and requires app registration/verification, greatly limiting abuse.