Suspicious Device Code Authentication Flow Masquerading as Microsoft Office

Bryant Smith@flowstate

•updated Jun 12, 2026•6•0•24

Identifies successful device code authentication flows where the client application is masquerading as a Microsoft Office client. This technique is commonly used by Phishing-as-a-Service (PhaaS) kits like EvilTokens for account takeover, by tricking users into authenticating a malicious application through a device code flow.