A device-code attack abuses a legitimate OAuth device authorization flow, which was designed for devices that cannot easily type a password, such as TVs or consoles. The attacker starts a sign-in session and gives the victim a code or sign-in prompt. If the victim is tricked into entering that code on a real identity provider page, the provider issues tokens to the attacker-controlled session.
This matters because the attacker is not stealing a password; they are stealing the authentication result. The issued access token or refresh token can let the attacker access cloud mail, files, and apps, sometimes without triggering another login prompt. Device-code attacks appear in phishing campaigns against Microsoft 365 and other cloud services. Defenses include phishing-resistant MFA, limiting or disabling device-code flows where possible, user awareness about unexpected sign-in prompts, and monitoring for unusual token issuance or OAuth activity.