EvilTokens Phishing Kit POST to /api/device/start Microsoft OAuth Device Code Initiation

Ankit Mehta@Secvyn

•updated Jun 24, 2026•0•0•1

This rule detects POST requests to the URI '/api/device/start' which is indicative of the EvilTokens phishing kit attempting to initiate a Microsoft OAuth Device Code flow. This technique is often used in phishing campaigns to gain unauthorized access to user accounts by tricking them into authenticating through a device code.