Passkey/SSO-themed AiTM or device-code auth compromise

Ibrahim Saud@tektrix

•updated Sep 16, 2026•2•0•1

Detects user authentication events that exhibit patterns consistent with Adversary-in-the-Middle (AiTM) phishing campaigns, specifically those leveraging passkey or SSO-themed lures and device-code authentication flows.