Tycoon Initiates Device-Code Authentication through the Victim
Detects a browser session requesting a device code and repeatedly polling the token endpoint while the victim completes authentication elsewhere. This behavior is indicative of an adversary using a device code phishing technique, often associated with the Tycoon threat actor.
Splunk (SPL)
