device code authentication

Device code authentication is a legitimate OAuth flow that allows users to sign in on devices without a full browser, but it is increasingly exploited by attackers to bypass multifactor authentication. A recent FBI warning highlights Kali365, a phishing-as-a-service platform that abuses Microsoft's device code flow to capture access tokens from Microsoft 365 users. Instead of stealing passwords, the attack tricks victims into completing a real Microsoft sign-in for an attacker-controlled device, rendering traditional URL-checking advice insufficient. This tag covers discussions about the security risks of device code authentication, including real-world phishing campaigns and mitigation strategies for enterprise IT and security professionals.