The "Enter Code" Trap: Inside the Device Code Flow Attack
Details
This live session breaks down one of the most interesting and underestimated OAuth attack vectors, the Device Code Flow. Attackers weaponize it to bypass MFA, silently harvest tokens, and pivot across Microsoft 365 and Entra ID environments with minimal friction.
The session follows the attacker’s path step by step, shows how the exploitation really works, decodes what happens behind the scenes in the protocol, and demonstrates how defenders can detect, disrupt, and reduce exposure.
What You Will Learn
- How OAuth Device Code Flow works at the protocol level and where trust boundaries collapse.
- How attackers automate device code harvesting and token replay to bypass MFA and conditional access with Token Tactics.
- How Entra ID logs expose traces of the attack and where the blind spots remain.
Who Should Attend
- SOC analysts and IR engineers who need to recognize token theft patterns.
- Cloud security teams working with Entra ID.
- Red teamers and penetration testers evaluating identity resilience.
- Architects are building identity protection strategies.
Notes
- Level 200-300 (Practical, technical, demo)
- The event will be recorded
- The event will be delivered in Hebrew
Community Channels
Cybersecurity
Microsoft Azure
Ethical Hacking
Information Security
Microsoft