Device code phishing exploits OAuth 2.0's device authorization grant flow to steal access tokens without any traditional vulnerability. An attacker requests a device code, phishes a victim into authenticating at a legitimate provider URL, then retrieves the resulting tokens. The attack is examined side-by-side in Azure and Google Cloud. In Azure, attackers can freely specify client IDs and resource scopes — including Microsoft's undocumented 'Family of Client IDs' — enabling tokens powerful enough to read email, join rogue devices, or even steal Primary Refresh Tokens. Google's implementation restricts device code flow to only four narrow scopes (GDrive file access and YouTube), requires attackers to register their own OAuth app (eliminating anonymity), and mandates app verification for sensitive permissions. The conclusion: same OAuth feature, radically different attack surfaces — Google's restrictive scope design effectively neuters device code phishing, while Azure's permissive implementation leaves a wide-open attack surface.
