attacking-oauth-with-device-code-phishing

MALICIOUS. This skill’s footprint is fully aligned with offensive phishing and token theft: it captures victim OAuth tokens, bypasses MFA via device-code abuse, replays tokens across Microsoft 365, and enumerates tenant data. Even with official Microsoft endpoints and partly legitimate tooling, the purpose and data flows are inherently hostile and give an AI agent high-risk attack capability.

This artifact is highly actionable malicious-instruction documentation for OAuth device-code/consent phishing and subsequent token abuse against Microsoft Entra ID. It provides the operational sequence and key parameters (including offline_access for refresh tokens), and it references tooling to exchange refresh tokens and enumerate/dump directory/mail data. Although it is not executable code in this snippet, its distribution would represent a significant supply-chain security risk by enabling credential/token theft and unauthorized access.

This module is a security-sensitive OAuth device-code token acquisition and capture tool. It retrieves user-assisted authorization material (verification URI/user_code), polls for access/refresh tokens, saves token responses to disk (potentially including refresh_token), and can redeem refresh tokens for additional scopes. There is no clear evidence of classic malware primitives (no obfuscation or arbitrary network exfiltration beyond OAuth), but the combination of token harvesting, persistence, and phishing-oriented framing makes it highly risky for supply-chain contexts and should be tightly controlled, audited, and protected against misuse.