Rapid Primary Refresh Token issuance to MS Graph after device code auth

Ibrahim Saud@tektrix

•updated Sep 17, 2026•0•0•4

Detects rapid succession of a successful device code authentication followed by the acquisition of a Primary Refresh Token (PRT) within 80 seconds for the same user. This pattern is indicative of device code phishing (or 'quishing'), where an adversary tricks a user into entering an authorization code into a malicious application to steal their session.