domains / families / security / attacking-oauth-with-device-code-phishing

attacking-oauth-with-device-code-phishing

separate

Run OAuth 2.0 device-code and illicit-consent phishing attacks against

When to use

• During an authorized red-team or assumed-breach engagement targeting Microsoft 365 / Entra ID where social-engineering is in scope
• When validating Conditional Access policies, MFA enforcement, and token-protection controls against real phishing techniques
• When testing whether an organization restricts the OAuth device-code flow or blocks unverified multi-tenant app consent
• When demonstrating MFA-bypass risk to justify phishing-resistant authentication (FIDO2) and token-binding controls
• When building detections (paired with the blue-team `hunting-saas-sso-token-abuse` skill) and you need realistic telemetry

When not to use

• unauthorized use against tenants without explicit written authorization

Skill page

Source