How device code phishing gives scammers access to your account
Device code phishing tricks users into approving a real OAuth sign-in, handing attackers account tokens.
Malwarebytes explains device code phishing, which abuses the OAuth 2.0 Device Authorization Grant meant for browsers-limited devices. An attacker starts a legitimate device-code sign-in and socially engineers the victim, often with a fake Teams invite or document share, into entering the code on a real page such as microsoft.com/devicelogin. Approving the request gives the attacker’s device tokens that can cover email, files, and other granted services, and multifactor authentication may not help because the victim completes it. The flow is included in kits such as EvilTokens.
- Scammers start a real device-code login and share the code.
- Victims enter it on a genuine page such as microsoft.com/devicelogin.
- Issued tokens can reach email, files, and other granted services.
- MFA may not stop it because the victim approves the prompt.
- EvilTokens is cited as a kit that includes this flow.
- Vendors
- Microsoft
- Products
- Microsoft Teams
- Malware
- EvilTokens
- Organizations
- MalwarebytesMicrosoft
From the original article
3 min read at malwarebytes.com
A scammer asks you to enter a code to open a file or join a meeting. Approving it could sign them in to your account instead.
By @MetallicaMVP · malwarebytes.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.