New Phishing Attacks Exploiting OAuth Authentication Flows (Live)
Jenko Hwong demonstrates live phishing attacks exploiting OAuth 2.0 device authorization flows, bypassing MFA and hijacking cloud session tokens.
Summary
The Mechanics of OAuth 2.0 Device Flow Phishing
OAuth 2.0 device authorization allows limited-input devices (such as smart TVs) to authenticate via a short user code entered on a phone or computer.
Live Exploitation of Device Code Authentication
Jenko Hwong demonstrates crafting deceptive phishing campaigns where victim users authenticate legitimate login prompts, unknowingly authorizing the attacker's session.
Bypassing Multi-Factor Authentication and Consent Prompts
Because authentication occurs directly on the legitimate identity provider domain, MFA is satisfied and token grants give attackers persistent API access without hosting phishing infrastructure.
Detection, Mitigation, and Token Governance
The author releases open-source auditing tools and provides identity architects with detection strategies for anomalous device code grants.
Related talks
Main Stage·46 min
Jenko Hwong
Jenko Hwong demonstrates weaponizing OAuth 2.0 Device Authorization Grant flows, creating phishing attacks that bypass MFA without fake login domains.
Creator Stage·19 min
Katherine Rackliffe
Presents empirical results from a university research study evaluating user vulnerability and defensive safeguards against AI voice-cloned vishing attacks.
Main Stage·43 min
Keanu Nys
Demonstrates how red teams can abuse legitimate Microsoft login branding parameters and OAuth endpoints to host convincing, high-trust phishing infrastructure.