Notion invite emails followed by device-code phishing click-through

Ibrahim Saud@tektrix

•updated Sep 23, 2026•1•0•2

This rule detects a multi-stage phishing campaign where an attacker uses legitimate Notion infrastructure to host PDF invitation lures. The detection correlates email delivery of a Notion-themed invitation with a subsequent user click on a URL containing device code authorization keywords (such as 'device', 'devicelogin', or 'code') within a 60-minute window, which is indicative of a device-code harvesting attack.