Spearphishing Email Lure Soliciting Device Code Entry

Smarth Arora@smarthxarora

•updated Jul 6, 2026•1•0•10

Detects spearphishing emails that contain both a link to the legitimate 'microsoft.com/devicelogin' page and the phrase 'device code'. This is a common social engineering tactic used to trick users into providing a device authorization code to an attacker, enabling them to bypass MFA and hijack user sessions via OAuth device code flow.