Device Code Phishing Exploits Microsoft OAuth 2.0 Implementation

A new phishing technique is exploiting the OAuth 2.0 Device Authorization Grant used by Microsoft. Attackers are tricking users into entering their credentials on a legitimate Microsoft site, thereby hijacking corporate accounts without needing passwords. This method leverages the one-time user code feature designed for input-constrained devices like smart TVs and IoT hardware. Victims are instructed to input codes on Microsoft's Identity Platform, making it difficult to detect fraudulent activity. The attack has raised alarms among cybersecurity experts, emphasizing the need for heightened awareness and protective measures against such tactics. Current defenses against this type of phishing are being discussed, but specific CVEs or tools were not mentioned in the articles.

Key Points: • Phishing attacks exploit Microsoft's OAuth 2.0 Device Authorization Grant. • Victims enter credentials on a legitimate Microsoft site, bypassing traditional phishing defenses. • Increased awareness and updated security measures are crucial to combat this emerging threat.