{"repo":"denniskniep/DeviceCodePhishing","free":true,"listed":false,"github":"https://github.com/denniskniep/DeviceCodePhishing","clone":"git clone https://github.com/denniskniep/DeviceCodePhishing.git","description":"This is a novel technique that leverages the well-known Device Code phishing approach. It dynamically initiates the flow when the victim opens the phishing link and instantly redirects them to the authentication page. No authentication method, not even FIDO, is able to protect against this type of attack.","language":"Go","stars":208,"topics":["phishing","security","device-code","fido2","azure","entra"],"license":"Apache-2.0","category":"security-tools","readme_excerpt":"DeviceCodePhishing TL;DR; EDIT 19.09.2025: Microsoft fixed it for normal Entra tenants, but still possible for federated Entra tenants. This is a novel technique that leverages the well-known Device Code phishing approach. It dynamically initiates the flow as soon as the victim opens the phishing link and instantly redirects them to the authentication page. A headless browser automates this by directly entering the generated Device Code into the webpage behind the scenes. This defeats the 10-minute token validity limitation and eliminates the need for the victim to manually perform these steps, elevating the efficiency of the attack to a new level. What makes Device Code phishing especially dangerous is that no authentication method, not even FIDO, is able to protect against this type of attack. Additionally, the victim interacts with the original website they expect, making it impossible to detect the attack based on a suspicious URL. Edit: Does not work on normal Entra tenants anymore, but ... Federated Entra tenats are still affected by that technique. The application now executes a preflight check if the specified domain belongs to a tenant, that is federated. If yes execution continues and the user is redirected immediatly to the federated sign-in page. Demo https://gist.github.com/user-attachments/assets/bf6d1c2d-7199-4394-824d-e6f57e8136a2 Description DeviceCodePhishing is an advanced phishing tool, which leverages the Device Code Flow. It can be used for phishing acce","default_branch":null,"files":null,"tree":[],"storefront":"/r/denniskniep","claimed":false,"request_supported":{"post":"https://gitbuyer.com/r/denniskniep/DeviceCodePhishing/request-supported","requests":0},"note":"indexed from public GitHub; nothing is for sale on this page. Clone it from GitHub. Paid listings live at /search."}