Device Code Phishing in Google Cloud and Azure | Huntress

This post analyzes the OAuth 2.0 device authorization (device code) flow and demonstrates how attackers can phish victims to obtain access and refresh tokens by requesting device codes, tricking users into authenticating, and polling token endpoints; it finds Microsoft Azure's implementation allows powerful token scopes (enabling severe tenant compromise in some cases) while Google limits supported scopes, substantially reducing the attack's impact.