Rapid PRT Acquisition Following Device Code Authentication

Ibrahim Saud@tektrix

•updated Sep 17, 2026•0•0•0

Detects an Azure AD Device Code authentication event followed within 60 seconds by a non-interactive Primary Refresh Token (PRT) sign-in event from the same user. This sequence is characteristic of adversary-in-the-middle (AiTM) phishing attacks where a user is tricked into authorizing a device code, and the adversary immediately leverages the resulting session/token to obtain a PRT for persistent access.