Full Report
All OAuth 2.0 implementations are equal. Some are just more equal than others. This blog covers device code phishing and compares OAuth implementations between Google and Azure. Does OAuth implementation impact the efficacy of hacker tradecraft? Find out here!
Analysis Summary
# Tool/Technique: OAuth 2.0 Device Code Phishing
## Overview
Device Code Phishing is an exploitation of the OAuth 2.0 **Device Authorization Grant** (RFC 8628). Originally designed for "input-constrained devices" (like smart TVs or printers) that lack a browser, the flow allows a user to authenticate a device by entering a short code on a separate, web-enabled machine. Attackers abuse this by tricking victims into entering an attacker-generated code into a legitimate provider login page, thereby granting the attacker an access token for the victim's account.
## Technical Details
- **Type:** Technique / Social Engineering
- **Platform:** Cloud Identity Providers (specifically Microsoft Azure/Entra ID and Google Cloud)
- **Capabilities:** MFA bypass, primary refresh token (PRT) acquisition, persistent account access without credential harvesting.
- **First Seen:** Public research emerged around 2021-2022 (notably by AADInternals and Dirk-jan Mollema).
## MITRE ATT&CK Mapping
- **TA0001 - Initial Access**
- **T1566.002 - Phishing: Spearphishing Link**
- **TA0006 - Credential Access**
- **T1528 - Steal Application Access Token**
- **TA0004 - Privilege Escalation**
- **T1548 - Abuse Elevation Control Mechanism**
## Functionality
### Core Capabilities
- **Legitimate Infrastructure Abuse:** The attacker uses the real Microsoft or Google login URLs, making the site appear trustworthy to the user and bypasses many link-crawlers.
- **MFA Bypass:** Since the victim performs the login on their own device, they complete the MFA challenge themselves. The resulting token is then passed to the attacker's "input-constrained" session.
- **Token Generation:** Upon successful victim authentication, the attacker’s script/tool polls the token endpoint and receives an access token and refresh token.
### Advanced Features
- **Cross-Platform Variation:**
- **Azure/Microsoft:** Highly susceptible because the device code flow is enabled by default for many first-party applications (like Azure CLI).
- **Google:** Generally more restrictive; often requires specific API configurations, though still vulnerable if certain Google Cloud SDK flows are targeted.
- **AI Integration:** Tools like **EvilTokens** have been observed using AI to automate and scale these campaigns across hundreds of organizations.
## Indicators of Compromise
- **Network Indicators:**
- `microsoft[.]com/devicelogin` (Legitimate but used in phishing lures)
- `google[.]com/device` (Legitimate but used in phishing lures)
- **Behavioral Indicators:**
- Logins for "niche" applications (e.g., Azure CLI, PowerShell, Google Cloud SDK) from unexpected geographic locations or IP addresses.
- Short time intervals between a "Device Code" request and a successful login from a different IP.
- Unusual User-Agent strings associated with CLI tools appearing in sign-in logs for non-technical users.
## Associated Threat Actors
- **General Cybercriminals:** Widely used for Business Email Compromise (BEC).
- **Campaign Specifics:** The **EvilTokens** campaign (targeting 300+ organizations).
- **State-Sponsored/APT:** Various groups targeting cloud environments for persistence.
## Detection Methods
- **Behavioral Detection:**
- Monitor Identity Provider (IdP) logs for the `deviceCode` grant type.
- Alert on successful logins where the "Application" is a command-line interface (CLI) but the user's role is non-technical (e.g., HR, Finance).
- Correlate "User Agent" changes within a single session.
- **SIEM/Log Queries:** Search for Entra ID Sign-in logs where `Authentication Protocol` is `Device Code`.
## Mitigation Strategies
- **Prevention measures:**
- **Conditional Access Policies:** Restrict the use of the Device Code Flow to specific trusted locations or compliant devices.
- **Block Niche Apps:** Explicitly block or restrict access to first-party CLI applications (like `Azure PowerShell` or `Google Cloud SDK`) for users who do not require them.
- **Hardening recommendations:**
- Educate users that they should never enter a code on a website unless they initiated the request themselves from a device they are physically holding.
- Move toward Phishing-Resistant MFA (FIDO2/WebAuthn).
## Related Tools/Techniques
- **AADInternals:** A toolkit often used to demonstrate or perform these attacks in Microsoft environments.
- **EvilTokens:** An AI-enhanced framework for scaling device code phishing.
- **Token Theft:** General category of stealing session fragments to bypass MFA.
- **ClickFix / BitB (Browser-in-the-Browser):** Other advanced phishing techniques often used in conjunction with identity attacks.