---
title: "Device Code Phishing: OAuth 2.0 Attacks in Google & Azure"
url: https://daily.dev/posts/device-code-phishing-oauth-2-0-attacks-in-google-azure-mad9xyexf
source_url: https://www.huntress.com/blog/oh-auth-2-0-device-code-phishing-in-google-cloud-and-azure
type: article
source: "Huntress Blog"
published: 2026-05-31T07:43:38.915Z
updated: 2026-05-31T08:54:32.932Z
tags: ["azure", "authentication", "gcp", "phishing", "oauth"]
reading_time: 17
upvotes: 0
comments: 0
language: en
---

> ## Documentation Index
> Fetch the complete documentation index at: https://daily.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Device Code Phishing: OAuth 2.0 Attacks in Google & Azure

**[Huntress Blog](https://daily.dev/sources/huntress-blog)** · 17 min read · 0 upvotes · 0 comments

## Summary

Device code phishing exploits OAuth 2.0's device authorization grant flow to steal access tokens without any traditional vulnerability. An attacker requests a device code, phishes a victim into authenticating at a legitimate provider URL, then retrieves the resulting tokens. The attack is examined side-by-side in Azure and Google Cloud. In Azure, attackers can freely specify client IDs and resource scopes — including Microsoft's undocumented 'Family of Client IDs' — enabling tokens powerful enough to read email, join rogue devices, or even steal Primary Refresh Tokens. Google's implementation restricts device code flow to only four narrow scopes (GDrive file access and YouTube), requires attackers to register their own OAuth app (eliminating anonymity), and mandates app verification for sensitive permissions. The conclusion: same OAuth feature, radically different attack surfaces — Google's restrictive scope design effectively neuters device code phishing, while Azure's permissive implementation leaves a wide-open attack surface.

## Full article

daily.dev links to this article rather than hosting it. Read it at the original source: <https://www.huntress.com/blog/oh-auth-2-0-device-code-phishing-in-google-cloud-and-azure>

## Similar posts on daily.dev

- [We Need to Talk About Device Code Phishing](https://daily.dev/posts/we-need-to-talk-about-device-code-phishing-x88bpk5tq) · Huntress Blog · 0 upvotes · 0 comments
- [When checking the URL isn't enough: phishing via the Microsoft identity platform](https://daily.dev/posts/when-checking-the-url-isn-t-enough-phishing-via-the-microsoft-identity-platform-wtxnir48k) · Securelist · 0 upvotes · 0 comments

---

Tags: [#azure](https://daily.dev/tags/azure), [#authentication](https://daily.dev/tags/authentication), [#gcp](https://daily.dev/tags/gcp), [#phishing](https://daily.dev/tags/phishing), [#oauth](https://daily.dev/tags/oauth)

[View this post on daily.dev](https://daily.dev/posts/device-code-phishing-oauth-2-0-attacks-in-google-azure-mad9xyexf)