standard

OAuth device code flow

OAuth 2.0 device authorization grant, which lets an input-limited device display a short code that the user enters on another device to complete sign-in and release tokens.

Current clusters

security1 publisher

Storm-3121 callers demand an urgent passkey update to harvest Microsoft 365 session tokens

Microsoft has tracked passkey- and SSO-themed help desk impersonation since May 2026, with the calls steering employees into adversary-in-the-middle proxies and device-code grants that hand over live Microsoft 365 sessions.

Publishers:bleepingcomputer.com

Reality

Evidence60
Adoption45
Hype gap+12
Incentives62
Confidence58

build1 publisher

A passkey 'upgrade' call ends with the attacker's phone number registered as an MFA method

Microsoft Security Research describes callers posing as IT staff to get a Microsoft 365 session relayed or minted to their own client. The lasting damage comes from the MFA method they then register.

Publishers:dev.to

Reality

Evidence55
Adoption40
Hype gap+15
Incentives55
Confidence55