Device-Code Authentication Flow Abuse (Storm-3121/Storm-3032)

Ibrahim Saud@tektrix

•updated Sep 16, 2026•6•0•7

Detects successful authentication events using the OAuth 2.0 device code flow. While a legitimate authentication method for devices without web browsers, this protocol is frequently abused by attackers in 'device code phishing' attacks to harvest access tokens and gain unauthorized access to cloud and SaaS applications.