OAuth's Overlooked Weakness: Device Code Flow Emerging as Phishing Weapon of Choice

Device code flow, originally designed for IoT and CLI tools lacking browser interfaces, has become a critical phishing vector—particularly through commercial platforms like Kali365 that enable even unskilled attackers to scale credential-less attacks. Many organizations unknowingly leave this authentication path enabled, unnecessarily expanding their attack surface and OAuth security risks. Restricting device code flow via Conditional Access policies is now essential to protect Microsoft 365 and other OAuth-dependent environments from this growing threat.