Russian threat actors have been abusing legitimate OAuth 2.0 authentication ... in the following diagram the attack flow targeting users by relying on a Visual Studio Code first-party application ...

The technique is known as device code phishing. It exploits “device code flow,” a form of authentication formalized in the industry-wide OAuth standard. Authentication through device code flow ...