Device Code Phishing Attempt from Unmanaged Device

nomit vyas@xoxo

•updated Jun 24, 2026•5•0•9

Detects attempts to abuse the device code flow targeting Microsoft Office and Authentication Broker applications from unmanaged, non-compliant devices with unbound tokens. This activity is indicative of device code phishing, where an attacker tricks a user into authenticating a malicious application.