OAuth Device Code Phishing: Azure vs. Google Compared
Source Reddit InfoSec News
Description
This threat involves phishing attacks exploiting the OAuth device code authorization flow, comparing techniques targeting Microsoft Azure and Google accounts. Attackers trick users into authorizing malicious applications by presenting fake device code prompts, leading to credential compromise or unauthorized access. The phishing leverages the OAuth device code flow, which is designed for devices with limited input capabilities, making it a novel vector for social engineering. Although no known exploits are currently widespread, the technique poses a medium risk due to its potential to bypass traditional phishing defenses. European organizations using Azure or Google identity services are at risk, especially those with remote or hybrid workforces relying on OAuth device code authentication. Mitigation requires user education on recognizing legitimate device code prompts, implementing conditional access policies, and monitoring OAuth consent grants for anomalies. Countries with high adoption of Microsoft and Google cloud services, such as the UK, Germany, France, and the Netherlands, are most likely to be affected. The suggested severity is medium, given the moderate impact on confidentiality and the social engineering nature of the attack, which requires user interaction but no prior authentication. Defenders should focus on awareness, monitoring, and restricting OAuth app consent to reduce risk.