Device-Code Phishing: The Scam That Doesn't Ask for Your Password
In today's threat deep dive, we're looking at device-code phishing. It's a scam that exploits a legitimate sign-in feature to gain access to your accounts, and it's been appearing in recent threat reports.
What is device-code phishing?
Many services let you sign in on a device with limited input, like a smart TV or games console, by showing a short code on the screen. You then go to a website on your phone or computer, enter the code, and approve the sign-in. This is called the device code flow.
Scammers abuse this by pretending to be from a service you use. They send a message saying there's an account problem and give you a code to enter on a genuine-looking page. Because the page is real, the code works. But instead of fixing your account, you've just authorised the scammer's device to access it.
Why it's effective
You never hand over a password, so it feels safe. The scammer doesn't need your password; they just need you to enter the code. This makes it harder to spot than traditional phishing.
How to spot and avoid it
The key rule: never enter a device code unless you started the sign-in process yourself. If you didn't just try to sign in on a new device, don't enter any code.
Treat unexpected messages about account problems with suspicion. Go to the service directly through their app or by typing the web address yourself.
If you receive a code you didn't request, report it and change your password. Check your account settings for any devices you don't recognise and remove them.
Other news this week
Google disrupted a large Android botnet affecting around 1.3 million devices, many of which were cheap TV boxes sold with malware pre-installed. If you own a cut-price streaming box from an unknown seller, consider resetting or replacing it.
DarkWatch is tracking an active dark web leak site associated with the DragonForce group. There's no need to visit it, but it's a reminder to use strong, unique passwords and turn on two-factor authentication.
Takeaway
Never enter a device code unless you initiated the sign-in. When in doubt, close the page and contact the company directly.
Related reading