Device code phishing the abuse of the OAuth 2.0 device authorization grant to steal access tokens has evolved from a niche redteam technique to an industrialscale threat in under six months. Designed for inputconstrained devices like smart TVs, printers, and so on, the device authorization login flow has been adopted by a wide range of apps and usecases that it wasn't originally.📖 Read more.
🔗 Via "The Hacker News"
----------
👁️ Seen on @cibsecurity