Phishing-lure click followed by device-code login within short window

Arnold Chan@slaz

•updated 13 days ago•1•0•2

Detects a suspected EvilTokens attack sequence where a user clicks a phishing URL and subsequently initiates a browser session to the Microsoft device-code authorization page (devicelogin) within 15 minutes, with the phishing lure domain appearing in the browser context.