# Device Code Phishing Attacks

Attacker initiates OAuth2 device code flow against Azure AD, phishes the code to a victim who authorizes it, yielding an access token for Graph API access.

- Payout: Research
- Severity: high
- Program: Microsoft
- Write-up by: Johann Rehberger
- Disclosed: 2022-11-21
- Write-up quality: 6/10
- Original: https://embracethered.com/blog/posts/2022/device-code-phishing/
- Library page: https://bugbountylibrary.com/r/blog%3Aembracethered-com-blog-posts-2022-device-code-phishing
- Tags: area:cloud domain:cloud impact:ato impact:data-leak kind:research platform:research sev:high tech:azure tech:oauth technique:recon vuln:account-takeover vuln:auth-bypass

**Target:** OAuth2 Device Authorization Grant endpoint (login.microsoftonline.com devicecode)
**Root cause:** Device code flow lets an attacker initiate the flow and have the victim complete authorization on their own session, binding the resulting token to the attacker's polling client.
**Steps:**
1. Attacker requests device code: `./ropci auth devicecode` (or POST to `https://login.microsoftonline.com/{tenant}.onmicrosoft.com/oauth2/v2.0/devicecode`)
2. Tool returns a verification URL and user code
3. Attacker emails victim the URL with the code embedded (optionally with extra params like `docid` for realism)
4. Victim clicks link, enters code, logs into Microsoft Online, authorizes the OAuth app (e.g. Office client_id)
5. Attacker's polling client receives the access token
6. Attacker uses ropci to read mail, search SharePoint, send mail, enumerate AAD users/groups/apps/devices via Graph API
**How found:** Observation that hardware tokens and passwordless auth push attackers toward alternative credential-theft vectors; identified OAuth2 Device Authorization Grant as a flow where the initiator and the authorizer can be different parties.
**Exploitation:** Attacker initiates device code flow, phishes the code to the victim, waits for victim to authorize, then polls and receives an access token usable against Microsoft Graph API for mail, SharePoint, and AAD enumeration. Limited by short device code validity window, so campaigns are automated at scale.
**Insight:** Device code flow separates flow initiation from authorization, so the party receiving the token need not be the one authenticating. Test any tenant with device code enabled by initiating a flow and checking whether a phished code yields a token with broad Graph scopes.