📝 Show notes
CyberAware Daily — 2026-11-03
- Today's deep dive: device-code phishing, a scam that abuses a genuine sign-in feature to steal account access.
- How it works: scammers ask you to enter a code on a real website, which links their device to your account without needing your password.
- Warning signs: unexpected requests to enter a code, messages about account problems, or codes you didn't request.
- What to do: never enter a code unless you started the sign-in, go to services directly, and check for unfamiliar devices.
- Google disrupts a 1.3 million-device Android botnet, linked to cheap TV boxes sold with malware pre-installed.
- DarkWatch tracks an active dark web leak site associated with the DragonForce group.
- Takeaway: never enter a device code unless you initiated the process yourself.
More at https://cyberawareuk.co.uk
📄 Full transcript
Welcome back to Cyber Aware UK. It's Tuesday and today is our Threat Deep Dive where we take one scam type and really get to grips with it.
And today's scam type is Device Code Phishing. It's been showing up in the weekly recaps and it's one of those that can catch out even careful people.
Right, so let's start with the basics. What is Device Code Phishing, Alex?
It starts with a real feature that lots of services use. You know when you sign into a smart TV or a games console and it says go to a website and enter a short code. That's the device code flow.
So it's meant to save you typing a long password with a remote control, but the scammers have found a way to abuse it.
Exactly. They send you a message pretending to be from, say, your email provider or a streaming service. They say there's a problem with your account and give you a code to enter on a genuine looking page.
And because the page is real, the code works. But what you've actually done is given the scammer access to your account.
That's the clever and nasty part. You never hand over a password so it feels safe. But behind the scenes, the scammer has linked their device to your account.
So what should people look out for?
The key warning sign is being asked to enter a code on a website when you didn't start the process yourself. If you didn't just try to sign in on a new device, don't enter any code.
And treat any unexpected message about account problems with suspicion. Even if it looks official, go to the service directly through their app or by typing the address yourself.
Also, if you do get a code you didn't ask for, report it and change your password. And check your account settings for any devices you don't recognize.
Google took action against a botnet that had infected around 1.3 million Android devices. Many of those were cheap TV boxes sold with malware already installed.
So if you bought a cut-price streaming box from an online marketplace, it could be part of this. But for most people with a normal phone or a TV from a major brand, the risk is low.
That's right, the advice is to be careful with very cheap devices from unknown sellers. And if you have one, consider resetting it or replacing it.
Before we wrap up, a quick word on Darkwatch. They're tracking an active dark web leak site linked to a group called Dragonforce. There's no need to go looking for it, but it's a reminder that data stolen in breaches can end up being traded.
And that's why good password habits matter. Use a password manager, turn on two-factor authentication, and don't reuse passwords across sites.
So our one takeaway for today, never enter a device code unless you started the sign-in process yourself. If in doubt, close the page and contact the company directly.
And if you think you've been caught out, change your password straight away and check for unfamiliar devices. Thanks for listening.
Stay safe, and we'll see you tomorrow.