TLDR Tech / IT
Phishing Is Shifting to OAuth
Device code phishing attacks - abusing OAuth login flows to trick users into granting access tokens on legitimate login pages, bypassing traditional credential-based defenses - have surged 37x. Attackers don't need passwords anymore, just user consent, making OAuth app governance and token visibility a new frontline for IT security.
Read the full story