Phishing Series 2026: Microsoft 365 Device-Code Authentication Phishing — Unfamiliar App + Burst Sign-Ins

Ibrahim Saud@tektrix

•updated 11 days ago•1•0•1

Detects potential OAuth device code phishing attempts by identifying sign-ins via the device code flow using applications not previously used by the specific user, especially when occurring in a burst pattern across multiple users.