PHISHING FOR REFRESH TOKENS

Summary from the TLDR InfoSec newsletter

This article examines an Attacker-in-the-Middle technique for stealing access and refresh tokens from the OAuth 2.0 authorization flow. The attacker first allows the user to go through the initial steps of the OAuth 2.0 flow until a response from the upstream server that has a header containing “nativeclient?code=“ is seen. This code can be used to request access and refresh tokens from the /oauth2/token endpoint.