PHISHING DESPITE FIDO, LEVERAGING A NOVEL TECHNIQUE BASED ON THE DEVICE CODE FLOW

Summary from the TLDR InfoSec newsletter

Enforcing FIDO as the sole MFA is often seen as phishing resistant. However, this post shows a new attack that utilizes the OAuth 2.0 Device Code Flow to downgrade MFA. The Device Code Flow enables a user to authenticate devices. In this method, an attacker uses a headless browser to automate the Device Code Flow, allowing the user to be phished through an attacker-controlled link without entering the code.