oauth device code

The oauth device code tag covers a phishing technique that abuses Microsoft's OAuth device-code authentication flow to steal access tokens for Microsoft 365 services like Outlook, Teams, and OneDrive. Recent discussions focus on the Kali365 phishing-as-a-service kit, which the FBI warned about in May 2026. This attack bypasses multifactor authentication by tricking users into completing a legitimate Microsoft sign-in on an attacker-controlled device, rather than stealing passwords. The tag content emphasizes that MFA alone is insufficient against such threats and that organizations need to harden identity infrastructure. Topics include token theft, device-code flow abuse, and practical security lessons for Windows and Microsoft 365 environments.