Kali365 - Device Login Portal Navigation (T1566.002)

Ibrahim Saud@tektrix

•updated Jun 22, 2026•7•0•6

Detects a user navigating to the Microsoft devicelogin portal immediately after clicking a link from an email, a precursor to Device Code OAuth phishing.