Device Code Phishing via Microsoft OAuth2 deviceauth endpoint (Kali365)

Ibrahim Saud@tektrix

•updated Sep 22, 2026•1•0•5

Detects proxy requests directed towards the Microsoft OAuth2 device authorization endpoint originating from suspicious referrers (e.g., .de top-level domains). This pattern is consistent with device code phishing attacks where users are redirected from external malicious sites to a legitimate Microsoft authentication page to obtain an authorization code.