device authorization grant news

When checking the URL isn’t enough: a Device Code Phishing attack via a Microsoft website

Researchers have identified a sophisticated phishing campaign that bypasses traditional URL-checking defenses by exploiting a legitimate Microsoft authentication feature. The attack leverages the Microsoft Identity Platform's Device Authorization Grant, a protocol designed for devices with limited input capabilities, such as smart TVs or IoT devices, to authenticate users.