Mailbox Harvesting via Graph API Shortly After Device Code Auth

Ibrahim Saud@tektrix

•updated Sep 17, 2026•0•0•0

Detects instances where a user successfully authenticates using the OAuth Device Code flow followed by subsequent mailbox operations (such as reading, sending, or deleting items) from a different IP address within a 10-minute window. This behavior is a strong indicator of adversary-in-the-middle phishing attacks where an attacker captures a session token and utilizes it from a remote location.