Device Code Phishing

Device code phishing abuses the legitimate OAuth device login flow: attackers trick victims into entering an attacker-generated code on a real login page, granting the attacker access tokens and bypassing MFA. The technique abuses the OAuth device authorization grant, built for smart TVs and command-line tools, to obtain a session with MFA already satisfied.