The technique is known as device code phishing. It exploits “device code flow,” a form of authentication formalized in the industry-wide OAuth standard. Authentication through device code flow ...

This story was originally published on Cybersecurity Dive. To receive daily news and insights, subscribe to our free daily Cybersecurity Dive newsletter. Russia-backed threat actors have attacked ...

One of the most effective measures is to disable any unnecessary device code authentication flows. If it isn’t essential for business operations, then it should be removed to eliminate a ...

Input constrained devices - those that lack keyboard or browser support, like smart TVs and some IoTs, rely on a code authentication flow to allow allowing users to sign into an application by ...

Device code authentication is a method whereby users can sign ... However, they are often not implemented as most organizations are not aware of this authentication flow or its capacity to be abused.

Cybersecurity company Volexity observed this activity since early March, right after a similar operation, reported in February by Volexity and Microsoft, that used Device Code Authentication ...

This convenience does come with a trade-off: Installing Authy on a new device requires its own authentication code, which Authy can send via text message. But Authy mitigates this in two ways ...