ARToken Device Code Phishing via Microsoft OAuth Device Flow

Ibrahim Saud@tektrix

•updated Sep 19, 2026•0•0•0

Detects user sign-ins using the OAuth 2.0 Device Code authentication flow in Entra ID. This flow, designed for input-constrained devices, is frequently abused by attackers in 'Device Code Phishing' (or ARToken) campaigns to steal session tokens and bypass MFA by tricking users into authorizing a malicious application via a web portal.